File name	9ac371b5b84adb63_~wrs{d5f99d08-15a0-4713-b838-ea7627e7713e}.tmp
File size	1536 bytes
File type	data
MD5	f28fe1721c5f808d3b5758dae5fda183
SHA1	f216860449682b55621ecb066642336c7efd6626
SHA256	9ac371b5b84adb63a1656cdd9fea626f3da06f97d44feca20e9b6c95cb5ca091
SHA512	08d4625a0b8e18c68610b40d77844fb280157e593e78200d7fc83016dcb07b9931e8fffcca54618e6051f0d10470844cc9f7520a7b0da85350c80eead81e210d
Ssdeep	6:IiiiiiiiiiRyMZ4/biguc8++l0k4NSWUVakskWwn:T4biguG+Ck4hUZsdwn
Yara	None matched
VirusTotal	Search for Analysis

File name	4826c0d860af884d_~wrs{3b7139b6-4ab2-481e-9253-be4edc065c9e}.tmp
File size	1024 bytes
File type	data
MD5	5d4d94ee7e06bbb0af9584119797b23a
SHA1	dbb111419c704f116efa8e72471dd83e86e49677
SHA256	4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1
SHA512	95f83ae84cafcced5eaf504546725c34d5f9710e5ca2d11761486970f2fbeccb25f9cf50bbfc272bd75e1a66a18b7783f09e1c1454afda519624bc2bb2f28ba4
Ssdeep	3:ol3lYdn:4Wn
Yara	None matched
VirusTotal	Search for Analysis

File name	b27b98df298e685e_~$normal.dotm
File size	162 bytes
File type	data
MD5	f7ae9c8c54bcb2cb8c1e3ba49eeb2b05
SHA1	bc2a4f523359d033d228e6832314973ba80cc83f
SHA256	b27b98df298e685e1215345691123b3b5d81be0b55ca5c8840070ab0d42246f8
SHA512	1e1a6fddfa3bf46ad45d64e43c6d2515e87faf4cac7fd51daa66fb2dc50ce7853b918f34b09ce108958ddd4f8e01cdbbed488d7f70ee4dfe21c977857772e5d5
Ssdeep	3:PtTtqlll/3l/1HXMDd1l//lCllflzNV:PtstK+7j
Yara	None matched
VirusTotal	Search for Analysis

File name	42433666cdf00c75_msforms.exd
File size	147284 bytes
File type	data
MD5	f6471a25ba5405179c913108c44a77e8
SHA1	680b7cf9c74b9fa45a07551cc558932ace4d89f9
SHA256	42433666cdf00c75303bdbb3c7ea37bd7f264c300d122be9a1021078714d5211
SHA512	fb48d967b0cf406690f199eb1e833fda514743c872c86318bfc6d3624920a379489d9f3bd30c5f9ff7f61d661aece2366d351feed22b07b2febb23fff7c893ed
Ssdeep	1536:CkBL3FNSc8SetKB96vQVCBumVMOej6mXmYarrJQcd1FaLcmB:CCJNSc83tKBAvQVCgOtmXmLpLmB
Yara	None matched
VirusTotal	Search for Analysis

Timestamp	Thread	Function	Arguments	Status	Return	Repeated

Timestamp	Thread	Function	Arguments	Status	Return	Repeated
2016-11-06 21:47:32.717953		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Microsoft Office\Office12\wwlib.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Microsoft Office\Office12\wwlib.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:32.727953		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Microsoft Office\Office12\wwlib.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Microsoft Office\Office12\wwlib.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:32.787953		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Microsoft Office\Office12\oart.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Microsoft Office\Office12\oart.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:32.797953		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Microsoft Office\Office12\oart.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Microsoft Office\Office12\oart.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:32.897953		NtOpenFile	file_handle => 0x00000038 filepath => C:\WINDOWS\system32\imm32.dll desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32\IMM32.DLL open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:32.897953		LdrLoadDll	basename => IMM32 module_address => 0x76390000 flags => 0 module_name => C:\WINDOWS\system32\IMM32.DLL	SUCCESS
2016-11-06 21:47:32.937953		LdrLoadDll	basename => LPK module_address => 0x629c0000 flags => 0 module_name => LPK.DLL	SUCCESS
2016-11-06 21:47:32.947953		NtOpenFile	file_handle => 0x00000048 filepath => \Device\KsecDD desired_access => 0x00100001 filepath_r => \Device\KsecDD open_options => 16 status_info => 0 share_access => 7	SUCCESS
2016-11-06 21:47:32.987953		LdrLoadDll	basename => wwlib module_address => 0x31240000 flags => 0 module_name => wwlib.dll	SUCCESS
2016-11-06 21:47:32.997953		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE12\mso.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:32.997953		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE12\mso.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:33.087953		NtOpenFile	file_handle => 0x00000064 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:33.097953		NtOpenFile	file_handle => 0x00000064 filepath => C:\Program Files\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:33.097953		LdrLoadDll	basename => mso module_address => 0x32600000 flags => 0 module_name => C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll	SUCCESS
2016-11-06 21:47:33.127953		LdrLoadDll	basename => MSO module_address => 0x32600000 flags => 0 module_name => MSO.dll	SUCCESS
2016-11-06 21:47:33.127953		LdrLoadDll	basename => mso module_address => 0x32600000 flags => 0 module_name => mso.dll	SUCCESS
2016-11-06 21:47:33.428953		NtOpenFile	file_handle => 0x00000078 filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Cultures\OFFICE.ODF desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\office12\Cultures\office.odf open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:33.448953		NtCreateFile	create_disposition => 1 file_handle => 0x0000007c filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Cultures\OFFICE.ODF desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\office12\Cultures\office.odf create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:33.468953		LdrLoadDll	basename => Kernel32 module_address => 0x7c800000 flags => 0 module_name => Kernel32.DLL	SUCCESS
2016-11-06 21:47:33.488953		LdrLoadDll	basename => wwintl module_address => 0x33d00000 flags => 2 module_name => C:\Program Files\Microsoft Office\Office12\1033\wwintl.dll	SUCCESS
2016-11-06 21:47:33.498953		LdrLoadDll	basename => ADVAPI32 module_address => 0x77dd0000 flags => 0 module_name => C:\WINDOWS\system32\ADVAPI32.DLL	SUCCESS
2016-11-06 21:47:33.648953		LdrLoadDll	basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll	SUCCESS
2016-11-06 21:47:33.648953		LdrLoadDll	basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => uxtheme.dll	SUCCESS
2016-11-06 21:47:33.658953		LdrLoadDll	basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll	SUCCESS
2016-11-06 21:47:33.668953		LdrLoadDll	basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll	SUCCESS
2016-11-06 21:47:33.678953		LdrLoadDll	basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll	SUCCESS
2016-11-06 21:47:33.698953		LdrLoadDll	basename => KERNEL32 module_address => 0x7c800000 flags => 0 module_name => C:\WINDOWS\system32\KERNEL32.DLL	SUCCESS
2016-11-06 21:47:33.828953		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:33.848953		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:33.868953		LdrLoadDll	basename => MSPTLS module_address => 0x6bdc0000 flags => 0 module_name => C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL	SUCCESS
2016-11-06 21:47:33.908953		NtOpenFile	file_handle => 0x000000c0 filepath => C:\WINDOWS\system32\shell32.dll desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\SHELL32.DLL open_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:33.918953		NtOpenFile	file_handle => 0x00000000 filepath => C:\WINDOWS\system32\SHELL32.DLL.124.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\SHELL32.DLL.124.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:33.928953		NtOpenFile	file_handle => 0x00000000 filepath => C:\WINDOWS\system32\SHELL32.DLL.124.Config desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\SHELL32.DLL.124.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:33.988953		LdrLoadDll	basename => comctl32 module_address => 0x773d0000 flags => 0 module_name => comctl32.dll	SUCCESS
2016-11-06 21:47:34.008953		LdrLoadDll	basename => comctl32 module_address => 0x5d090000 flags => 0 module_name => comctl32.dll	SUCCESS
2016-11-06 21:47:34.008953		LdrLoadDll	basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => SHELL32.DLL	SUCCESS
2016-11-06 21:47:34.039953		LdrLoadDll	basename => Comctl32 module_address => 0x773d0000 flags => 0 module_name => Comctl32.dll	SUCCESS
2016-11-06 21:47:34.049953		LdrLoadDll	basename => rpcrt4 module_address => 0x77e70000 flags => 0 module_name => rpcrt4.dll	SUCCESS
2016-11-06 21:47:34.059953		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:34.069953		NtWriteFile	buffer => H ¸¸ xW44Í«ï #Eg‰«]ˆŠëÉŸè+H` file_handle => 0x00000114 offset => 0	SUCCESS
2016-11-06 21:47:34.109953		LdrLoadDll	basename => MSCTF module_address => 0x74720000 flags => 0 module_name => C:\WINDOWS\system32\MSCTF.dll	SUCCESS
2016-11-06 21:47:34.119953		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:34.119953		NtWriteFile	buffer => H ¸¸ xW44Í«ï #Eg‰«]ˆŠëÉŸè+H` file_handle => 0x00000118 offset => 0	SUCCESS
2016-11-06 21:47:34.139953		LdrLoadDll	basename => version module_address => 0x77c00000 flags => 0 module_name => version.dll	SUCCESS
2016-11-06 21:47:34.139953		NtOpenFile	file_handle => 0x00000110 filepath => C:\WINDOWS\system32\MSCTFIME.IME desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32\msctfime.ime open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:34.159953		NtCreateFile	create_disposition => 1 file_handle => 0x0000011c filepath => C:\WINDOWS\system32\MSCTFIME.IME desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\msctfime.ime create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:34.169953		NtOpenFile	file_handle => 0x00000110 filepath => C:\WINDOWS\system32\MSCTFIME.IME desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32\msctfime.ime open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:34.179953		NtCreateFile	create_disposition => 1 file_handle => 0x0000011c filepath => C:\WINDOWS\system32\MSCTFIME.IME desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\msctfime.ime create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:34.189953		LdrLoadDll	basename => ole32 module_address => 0x774e0000 flags => 0 module_name => C:\WINDOWS\system32\ole32.dll	SUCCESS
2016-11-06 21:47:34.219953		LdrLoadDll	basename => msctfime.ime module_address => 0x755c0000 flags => 0 module_name => C:\WINDOWS\system32\msctfime.ime	SUCCESS
2016-11-06 21:47:34.219953		LdrLoadDll	basename => msctfime.ime module_address => 0x755c0000 flags => 0 module_name => C:\WINDOWS\system32\msctfime.ime	SUCCESS
2016-11-06 21:47:34.249953		LdrLoadDll	basename => MSORES module_address => 0x00fe0000 flags => 2 module_name => C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSORES.DLL	SUCCESS
2016-11-06 21:47:34.249953		LdrLoadDll	basename => MSOINTL module_address => 0x01740000 flags => 2 module_name => C:\Program Files\Common Files\Microsoft Shared\office12\1033\MSOINTL.DLL	SUCCESS
2016-11-06 21:47:34.259953		LdrLoadDll	basename => Comctl32 module_address => 0x773d0000 flags => 0 module_name => Comctl32.dll	SUCCESS
2016-11-06 21:47:34.269953		LdrLoadDll	basename => mscoree module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\mscoree.dll	FAILURE
2016-11-06 21:47:34.279953		LdrLoadDll	basename => VERSION module_address => 0x77c00000 flags => 0 module_name => VERSION.DLL	SUCCESS
2016-11-06 21:47:34.289953		NtOpenFile	file_handle => 0x00000130 filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:34.319953		NtCreateFile	create_disposition => 1 file_handle => 0x00000134 filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:34.329953		NtOpenFile	file_handle => 0x00000130 filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:34.329953		NtCreateFile	create_disposition => 1 file_handle => 0x00000134 filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:34.359953		NtCreateFile	create_disposition => 1 file_handle => 0x00000130 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word12.pip desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word12.pip create_options => 4194404 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:34.369953		NtCreateFile	create_disposition => 1 file_handle => 0x00000134 filepath => C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\OPA12.BAK desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\OPA12.BAK create_options => 2097252 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:34.409953		NtCreateFile	create_disposition => 2 file_handle => 0x00000000 filepath => C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa12.dat desired_access => 0x40110080 file_attributes => 32 filepath_r => \??\C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa12.dat create_options => 100 status_info => 4294967295 share_access => 0	FAILURE
2016-11-06 21:47:34.409953		NtOpenFile	file_handle => 0x00000134 filepath => C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa12.dat desired_access => 0x00100100 filepath_r => \??\C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa12.dat open_options => 2113568 status_info => 1 share_access => 7	SUCCESS
2016-11-06 21:47:34.449953		NtCreateFile	create_disposition => 1 file_handle => 0x00000134 filepath => C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa12.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa12.dat create_options => 4196448 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:34.459953		NtCreateFile	create_disposition => 1 file_handle => 0x00000134 filepath => C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa12.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa12.dat create_options => 4196448 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:34.960953		NtCreateFile	create_disposition => 1 file_handle => 0x00000134 filepath => C:\Program Files\Microsoft Office\Office12\ID_00030.DPC desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Microsoft Office\Office12\ID_00030.DPC create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:35.170953		OleInitialize		SUCCESS
2016-11-06 21:47:35.190953		LdrLoadDll	basename => MSO module_address => 0x32600000 flags => 0 module_name => MSO.dll	SUCCESS
2016-11-06 21:47:35.260953		LdrLoadDll	basename => Winspool.DRV module_address => 0x73000000 flags => 0 module_name => Winspool.DRV	SUCCESS
2016-11-06 21:47:35.290953		NtOpenFile	file_handle => 0x00000000 filepath => C:\WINDOWS\system32\spool\drivers\w32x86\3\msonpui.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\msonpui.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:35.300953		NtOpenFile	file_handle => 0x00000000 filepath => C:\WINDOWS\system32\spool\drivers\w32x86\3\msonpui.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\msonpui.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:35.330953		LdrLoadDll	basename => msonpui module_address => 0x01640000 flags => 0 module_name => C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\msonpui.dll	SUCCESS
2016-11-06 21:47:35.360953		CoInitializeEx	options => 2	FAILURE
2016-11-06 21:47:35.370953		NtOpenFile	file_handle => 0x0000015c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:35.380953		NtOpenFile	file_handle => 0x0000015c filepath => C:\Program Files\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:35.390953		NtOpenFile	file_handle => 0x00000160 filepath => C:\Program Files\Microsoft Office\Office12\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Microsoft Office\Office12\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:35.400953		NtOpenFile	file_handle => 0x00000160 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:35.441953		LdrLoadDll	basename => UxTheme module_address => 0x5ad70000 flags => 0 module_name => UxTheme.DLL	SUCCESS
2016-11-06 21:47:35.491953		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Microsoft Office\Office12\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Microsoft Office\Office12\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:35.501953		NtOpenFile	file_handle => 0x00000168 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:35.511953		NtCreateFile	create_disposition => 1 file_handle => 0x00000168 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm create_options => 4194400 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:35.521953		NtCreateFile	create_disposition => 1 file_handle => 0x0000016c filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:35.531953		NtCreateFile	create_disposition => 1 file_handle => 0x0000016c filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm create_options => 4194400 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:35.541953		NtCreateFile	create_disposition => 5 file_handle => 0x00000170 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dotm desired_access => 0x40100080 file_attributes => 2 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dotm create_options => 4194400 status_info => 2 share_access => 0	SUCCESS
2016-11-06 21:47:35.551953		NtWriteFile	buffer => PKSJ file_handle => 0x00000170 offset => 0	SUCCESS
2016-11-06 21:47:35.571953		NtWriteFile	buffer => PKSJITS,¬b2¬b2å¸2Èå¸2 xæ¸20ç¸2ðç¸2°è¸2 file_handle => 0x00000170 offset => 0	SUCCESS
2016-11-06 21:47:35.591953		LdrLoadDll	basename => ole32 module_address => 0x774e0000 flags => 0 module_name => ole32.dll	SUCCESS
2016-11-06 21:47:35.591953		CoInitializeEx	options => 6	FAILURE
2016-11-06 21:47:35.601953		LdrLoadDll	basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => C:\WINDOWS\system32\SHELL32.dll	SUCCESS
2016-11-06 21:47:35.611953		LdrLoadDll	basename => SETUPAPI module_address => 0x77920000 flags => 0 module_name => SETUPAPI.dll	SUCCESS
2016-11-06 21:47:35.621953		NtCreateFile	create_disposition => 1 file_handle => 0x00000190 filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:35.621953		NtWriteFile	buffer => H ¸¸ xW44Í«ï #Eg‰«]ˆŠëÉŸè+H` file_handle => 0x00000190 offset => 0	SUCCESS
2016-11-06 21:47:35.641953		NtCreateFile	create_disposition => 1 file_handle => 0x0000018c filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:35.641953		NtWriteFile	buffer => H ¸¸ xW44Í«ï #Eg‰«]ˆŠëÉŸè+H` file_handle => 0x0000018c offset => 0	SUCCESS
2016-11-06 21:47:35.671953		NtOpenFile	file_handle => 0x00000194 filepath => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-06 21:47:35.681953		NtOpenFile	file_handle => 0x00000194 filepath => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 16 status_info => 0 share_access => 3	SUCCESS
2016-11-06 21:47:35.681953		NtCreateFile	create_disposition => 1 file_handle => 0x00000194 filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-06 21:47:35.701953		NtOpenFile	file_handle => 0x00000194 filepath => \??\STORAGE#Volume#1&30a96598&0&SignatureC725C725Offset7E00Length27F4DB200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\STORAGE#Volume#1&30a96598&0&SignatureC725C725Offset7E00Length27F4DB200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-06 21:47:35.701953		NtOpenFile	file_handle => 0x00000194 filepath => \??\STORAGE#Volume#1&30a96598&0&SignatureC725C725Offset7E00Length27F4DB200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\STORAGE#Volume#1&30a96598&0&SignatureC725C725Offset7E00Length27F4DB200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 16 status_info => 0 share_access => 3	SUCCESS
2016-11-06 21:47:35.731953		NtCreateFile	create_disposition => 1 file_handle => 0x00000194 filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-06 21:47:35.731953		NtCreateFile	create_disposition => 1 file_handle => 0x00000194 filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-06 21:47:35.771953		NtCreateFile	create_disposition => 1 file_handle => 0x00000194 filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-06 21:47:35.851953		NtCreateFile	create_disposition => 1 file_handle => 0x00000194 filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-06 21:47:35.881953		NtCreateFile	create_disposition => 1 file_handle => 0x00000194 filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-06 21:47:35.921953		NtOpenFile	file_handle => 0x00000198 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:35.921953		LdrLoadDll	basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => SHELL32.dll	SUCCESS
2016-11-06 21:47:35.921953		LdrLoadDll	basename => ole32 module_address => 0x774e0000 flags => 0 module_name => ole32.dll	SUCCESS
2016-11-06 21:47:35.971953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.001953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.001953		CoUninitialize		SUCCESS
2016-11-06 21:47:36.011953		NtOpenFile	file_handle => 0x00000194 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.011953		NtOpenFile	file_handle => 0x00000194 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.021953		NtOpenFile	file_handle => 0x00000194 filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.021953		NtOpenFile	file_handle => 0x00000194 filepath => C:\Documents and Settings\Administrator\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-06 21:47:36.051953		NtOpenFile	file_handle => 0x00000194 filepath => C:\Documents and Settings\Administrator\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-06 21:47:36.091953		NtOpenFile	file_handle => 0x00000194 filepath => C:\Documents and Settings\Administrator\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-06 21:47:36.122953		NtOpenFile	file_handle => 0x00000194 filepath => C:\Documents and Settings\Administrator\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.132953		NtOpenFile	file_handle => 0x00000194 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.162953		NtOpenFile	file_handle => 0x00000194 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.192953		CoInitializeEx	options => 6	FAILURE
2016-11-06 21:47:36.202953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.202953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.212953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.222953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\Documents and Settings\Administrator\My Documents\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\Administrator\My Documents\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-06 21:47:36.232953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\Documents and Settings\Administrator\My Documents\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\Administrator\My Documents\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-06 21:47:36.262953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\Documents and Settings\Administrator\My Documents\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\Administrator\My Documents\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-06 21:47:36.272953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\Documents and Settings\Administrator\My Documents\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\Administrator\My Documents\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-06 21:47:36.322953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\Documents and Settings\Administrator\My Documents\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\Administrator\My Documents\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-06 21:47:36.332953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\Documents and Settings\Administrator\My Documents\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\Administrator\My Documents\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-06 21:47:36.342953		CoUninitialize		SUCCESS
2016-11-06 21:47:36.342953		CoInitializeEx	options => 6	FAILURE
2016-11-06 21:47:36.352953		NtOpenFile	file_handle => 0x00000194 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.362953		NtOpenFile	file_handle => 0x00000194 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.372953		NtOpenFile	file_handle => 0x00000194 filepath => C:\Documents and Settings\All Users\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.382953		NtOpenFile	file_handle => 0x00000194 filepath => C:\Documents and Settings\All Users\Documents\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\All Users\Documents\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-06 21:47:36.392953		NtOpenFile	file_handle => 0x00000194 filepath => C:\Documents and Settings\All Users\Documents\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\All Users\Documents\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-06 21:47:36.402953		NtOpenFile	file_handle => 0x00000194 filepath => C:\Documents and Settings\All Users\Documents\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\All Users\Documents\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-06 21:47:36.412953		CoUninitialize		SUCCESS
2016-11-06 21:47:36.412953		CoInitializeEx	options => 6	FAILURE
2016-11-06 21:47:36.422953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.432953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.442953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\Documents and Settings\All Users\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.442953		CoUninitialize		SUCCESS
2016-11-06 21:47:36.452953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.472953		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm create_options => 4194400 status_info => 4294967295 share_access => 0	FAILURE
2016-11-06 21:47:36.472953		NtCreateFile	create_disposition => 1 file_handle => 0x000001a4 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm create_options => 4194400 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.482953		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm create_options => 96 status_info => 4294967295 share_access => 0	FAILURE
2016-11-06 21:47:36.492953		NtCreateFile	create_disposition => 1 file_handle => 0x000001a4 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm create_options => 4194400 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.502953		NtCreateFile	create_disposition => 1 file_handle => 0x000001a4 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:36.522953		LdrLoadDll	basename => OLEAUT32 module_address => 0x77120000 flags => 0 module_name => OLEAUT32.dll	SUCCESS
2016-11-06 21:47:36.572953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.582953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.592953		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE12\riched20.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\office12\riched20.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:36.602953		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE12\riched20.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\office12\riched20.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:36.632953		LdrLoadDll	basename => riched20 module_address => 0x3a780000 flags => 0 module_name => C:\Program Files\Common Files\Microsoft Shared\office12\riched20.dll	SUCCESS
2016-11-06 21:47:36.632953		LdrLoadDll	basename => OLEAUT32 module_address => 0x77120000 flags => 0 module_name => OLEAUT32.DLL	SUCCESS
2016-11-06 21:47:36.642953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.652953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.662953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.662953		CoCreateInstanceEx	class_context => 0 clsid => {00000000-0000-0000-0000-000000000000} iid => []	FAILURE
2016-11-06 21:47:36.672953		LdrLoadDll	basename => oleaut32 module_address => 0x77120000 flags => 0 module_name => oleaut32.dll	SUCCESS
2016-11-06 21:47:36.672953		LdrLoadDll	basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => C:\WINDOWS\system32\kernel32.dll	SUCCESS
2016-11-06 21:47:36.682953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.692953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.702953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.712953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.722953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.742953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.752953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.782953		CoInitializeSecurity		SUCCESS
2016-11-06 21:47:36.782953		LdrLoadDll	basename => OLE32 module_address => 0x774e0000 flags => 0 module_name => OLE32	SUCCESS
2016-11-06 21:47:36.802953		LdrLoadDll	basename => OLE32 module_address => 0x774e0000 flags => 0 module_name => OLE32.DLL	SUCCESS
2016-11-06 21:47:36.813953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.823953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.833953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.843953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.853953		CoCreateInstance	class_context => 23 clsid => {88d969ec-8b8b-4c3d-859e-af6cd158be0f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:36.903953		NtCreateFile	create_disposition => 5 file_handle => 0x00000194 filepath => C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRS{3B7139B6-4AB2-481E-9253-BE4EDC065C9E}.tmp desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRS{3B7139B6-4AB2-481E-9253-BE4EDC065C9E}.tmp create_options => 4194400 status_info => 2 share_access => 0	SUCCESS
2016-11-06 21:47:36.913953		NtWriteFile	buffer => ý file_handle => 0x00000194 offset => 0	SUCCESS
2016-11-06 21:47:36.953953		CoCreateInstance	class_context => 23 clsid => {88d969ef-f192-11d4-a65f-0040963251e5} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:37.003953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Office\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Office\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:37.213953		LdrLoadDll	basename => gdi32 module_address => 0x77f10000 flags => 0 module_name => gdi32.DLL	SUCCESS
2016-11-06 21:47:37.233953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\WINDOWS\system32\MSIMTF.dll desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32\Msimtf.dll open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:37.253953		NtOpenFile	file_handle => 0x0000024c filepath => C:\WINDOWS\system32\MSIMTF.dll desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32\Msimtf.dll open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:37.283953		NtOpenFile	file_handle => 0x000001a0 filepath => C:\WINDOWS\system32\MSIMTF.dll desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32\Msimtf.dll open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:37.363953		NtOpenFile	file_handle => 0x0000024c filepath => C:\WINDOWS\system32\MSIMTF.dll desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32\Msimtf.dll open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:37.433953		NtCreateFile	create_disposition => 1 file_handle => 0x00000254 filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:37.433953		NtWriteFile	buffer => H ¸¸ xW44Í«ï #Eg‰«]ˆŠëÉŸè+H` file_handle => 0x00000254 offset => 0	SUCCESS
2016-11-06 21:47:37.604953		NtOpenFile	file_handle => 0x00000074 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:37.614953		NtOpenFile	file_handle => 0x00000290 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:37.614953		NtOpenFile	file_handle => 0x00000290 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:37.624953		NtOpenFile	file_handle => 0x00000290 filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:37.624953		NtOpenFile	file_handle => 0x00000290 filepath => C:\Documents and Settings\Administrator\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Local Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:37.634953		NtOpenFile	file_handle => 0x00000290 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Local Settings\Temp\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:37.654953		NtOpenFile	file_handle => 0x00000290 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:37.674953		NtCreateFile	create_disposition => 1 file_handle => 0x00000074 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\billing_doc_60787.doc desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\billing_doc_60787.doc create_options => 4194400 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:37.684953		NtCreateFile	create_disposition => 1 file_handle => 0x00000074 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\billing_doc_60787.doc desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\billing_doc_60787.doc create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:37.714953		NtCreateFile	create_disposition => 2 file_handle => 0x000002a0 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\~DFDA20.tmp desired_access => 0xc0110080 file_attributes => 256 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFDA20.tmp create_options => 4192 status_info => 2 share_access => 7	SUCCESS
2016-11-06 21:47:37.734953		NtOpenFile	file_handle => 0x0000007c filepath => C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL desired_access => 0x00100020 filepath_r => \??\C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:37.794953		NtCreateFile	create_disposition => 1 file_handle => 0x000002ac filepath => C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:37.834953		NtOpenFile	file_handle => 0x0000007c filepath => C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL desired_access => 0x00100020 filepath_r => \??\C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:37.844953		NtCreateFile	create_disposition => 1 file_handle => 0x000002ac filepath => C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:37.854953		NtOpenFile	file_handle => 0x0000007c filepath => C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:37.864953		NtCreateFile	create_disposition => 1 file_handle => 0x000002ac filepath => C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:37.874953		NtOpenFile	file_handle => 0x0000007c filepath => C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:37.884953		NtCreateFile	create_disposition => 1 file_handle => 0x000002ac filepath => C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:37.934953		NtCreateFile	create_disposition => 5 file_handle => 0x0000007c filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\~$lling_doc_60787.doc desired_access => 0x40100080 file_attributes => 2 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~$lling_doc_60787.doc create_options => 4194400 status_info => 2 share_access => 0	SUCCESS
2016-11-06 21:47:37.944953		NtWriteFile	buffer => PKSJ file_handle => 0x0000007c offset => 0	SUCCESS
2016-11-06 21:47:37.964953		NtWriteFile	buffer => PKSJITS,¬b2¬b2å¸2Èå¸2 xæ¸20ç¸2ðç¸2°è¸2 file_handle => 0x0000007c offset => 0	SUCCESS
2016-11-06 21:47:38.124953		NtOpenFile	file_handle => 0x000002ac filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.134953		NtOpenFile	file_handle => 0x000002ac filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.144953		NtOpenFile	file_handle => 0x000002ac filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.154953		NtOpenFile	file_handle => 0x000002ac filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.164953		NtOpenFile	file_handle => 0x000002ac filepath => C:\Documents and Settings\Administrator\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.164953		NtOpenFile	file_handle => 0x000002ac filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.174953		NtOpenFile	file_handle => 0x000002ac filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.184953		NtOpenFile	file_handle => 0x000002ac filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.215953		NtOpenFile	file_handle => 0x000002ac filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.225953		NtOpenFile	file_handle => 0x000002ac filepath => C:\Documents and Settings\Administrator\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.235953		NtOpenFile	file_handle => 0x000002ac filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.305953		NtOpenFile	file_handle => 0x000000e0 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.315953		NtOpenFile	file_handle => 0x000000e0 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.325953		NtOpenFile	file_handle => 0x000000e0 filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.335953		NtOpenFile	file_handle => 0x000000e0 filepath => C:\Documents and Settings\Administrator\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:38.485953		NtCreateFile	create_disposition => 5 file_handle => 0x000002b4 filepath => C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRS{FC87C8F0-EBC9-4864-A60B-22048ED3BDBE}.tmp desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRS{FC87C8F0-EBC9-4864-A60B-22048ED3BDBE}.tmp create_options => 4194400 status_info => 2 share_access => 0	SUCCESS
2016-11-06 21:47:38.575953		NtOpenFile	file_handle => 0x00000000 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\review.rcd desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\review.rcd open_options => 96 status_info => 4294967295 share_access => 7	FAILURE
2016-11-06 21:47:38.585953		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\review.rcd desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\review.rcd create_options => 4194404 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:38.595953		NtOpenFile	file_handle => 0x00000000 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\adhoc.rcd desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\adhoc.rcd open_options => 96 status_info => 4294967295 share_access => 7	FAILURE
2016-11-06 21:47:38.605953		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\adhoc.rcd desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\adhoc.rcd create_options => 4194404 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:38.715953		NtCreateFile	create_disposition => 5 file_handle => 0x000002c4 filepath => C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRS{D5F99D08-15A0-4713-B838-EA7627E7713E}.tmp desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRS{D5F99D08-15A0-4713-B838-EA7627E7713E}.tmp create_options => 4194400 status_info => 2 share_access => 0	SUCCESS
2016-11-06 21:47:38.725953		NtWriteFile	buffer => ( ( ( ( ( ( ( ( ( ( ( ITS PKSJ P  "&*.6@Dúúúúúúúúúúúøøøø gdDÌ  "$&(*,.46>@BüõüõüîüîüçüçüàüÙüÒüËüÄüÀüÀüÀhDÌ j óðhDÌ j èðhDÌ j çðhDÌ j àðhDÌ j ßðhDÌ j LðhDÌ j KðhDÌ j JðhDÌhž'N file_handle => 0x000002c4 offset => 0	SUCCESS
2016-11-06 21:47:38.745953		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE12\OGL.DLL.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\OFFICE12\OGL.DLL.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:38.755953		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE12\OGL.DLL.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\OFFICE12\OGL.DLL.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:38.795953		LdrLoadDll	basename => OGL module_address => 0x3bd10000 flags => 0 module_name => C:\Program Files\Common Files\Microsoft Shared\OFFICE12\OGL.DLL	SUCCESS
2016-11-06 21:47:38.815953		LdrLoadDll	basename => WTSAPI32 module_address => 0x76f50000 flags => 0 module_name => WTSAPI32.DLL	SUCCESS
2016-11-06 21:47:39.006953		NtOpenFile	file_handle => 0x000002ec filepath => C:\WINDOWS\system32\MSIMTF.dll desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32\Msimtf.dll open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:47:39.046953		LdrLoadDll	basename => Shlwapi module_address => 0x77f60000 flags => 0 module_name => Shlwapi.dll	SUCCESS
2016-11-06 21:47:39.046953		LdrLoadDll	basename => Shlwapi module_address => 0x77f60000 flags => 0 module_name => Shlwapi.DLL	SUCCESS
2016-11-06 21:47:39.066953		CoInitializeEx	options => 2	SUCCESS
2016-11-06 21:47:39.076953		NtOpenFile	file_handle => 0x00000318 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.086953		NtOpenFile	file_handle => 0x00000318 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.096953		NtOpenFile	file_handle => 0x00000318 filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.106953		NtOpenFile	file_handle => 0x00000318 filepath => C:\Documents and Settings\Administrator\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Local Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.106953		NtOpenFile	file_handle => 0x00000318 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Local Settings\Temp\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.146953		NtOpenFile	file_handle => 0x000002f8 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.156953		NtOpenFile	file_handle => 0x000002f8 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.166953		NtOpenFile	file_handle => 0x000002f8 filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.176953		NtOpenFile	file_handle => 0x000002f8 filepath => C:\Documents and Settings\Administrator\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.186953		NtOpenFile	file_handle => 0x00000318 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.196953		NtOpenFile	file_handle => 0x00000318 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.206953		NtOpenFile	file_handle => 0x00000318 filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.206953		NtOpenFile	file_handle => 0x00000318 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Local Settings\Temp\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.226953		NtOpenFile	file_handle => 0x00000318 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.236953		NtOpenFile	file_handle => 0x00000318 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.246953		NtOpenFile	file_handle => 0x00000318 filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.256953		NtOpenFile	file_handle => 0x00000318 filepath => C:\Documents and Settings\Administrator\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:39.296953		OleInitialize		FAILURE
2016-11-06 21:47:39.306953		LdrLoadDll	basename => msi module_address => 0x3fde0000 flags => 0 module_name => msi.dll	SUCCESS
2016-11-06 21:47:39.306953		LdrLoadDll	basename => user32 module_address => 0x7e410000 flags => 0 module_name => user32.dll	SUCCESS
2016-11-06 21:47:40.828953		LdrLoadDll	basename => SXS module_address => 0x7e720000 flags => 0 module_name => SXS.DLL	SUCCESS
2016-11-06 21:47:40.868953		NtCreateFile	create_disposition => 1 file_handle => 0x00000350 filepath => C:\Program Files\Microsoft Office\Office12\MSWORD.OLB desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Microsoft Office\Office12\MSWORD.OLB create_options => 2144 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:41.129953		LdrLoadDll	basename => VBE6 module_address => 0x65000000 flags => 0 module_name => C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	SUCCESS
2016-11-06 21:47:41.309953		LdrLoadDll	basename => VBE6INTL module_address => 0x65300000 flags => 0 module_name => C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\1033\VBE6INTL.DLL	SUCCESS
2016-11-06 21:47:41.319953		OleInitialize		FAILURE
2016-11-06 21:47:41.319953		LdrLoadDll	basename => OLEAUT32 module_address => 0x77120000 flags => 0 module_name => OLEAUT32.DLL	SUCCESS
2016-11-06 21:47:41.339953		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF{B8CD13DD-D2C2-43C1-8E86-ABBE45AFAF43}.tmp desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF{B8CD13DD-D2C2-43C1-8E86-ABBE45AFAF43}.tmp create_options => 4194400 status_info => 4294967295 share_access => 3	FAILURE
2016-11-06 21:47:41.349953		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF{B8CD13DD-D2C2-43C1-8E86-ABBE45AFAF43}.tmp desired_access => 0x00120089 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF{B8CD13DD-D2C2-43C1-8E86-ABBE45AFAF43}.tmp create_options => 0 status_info => 4294967295 share_access => 7	FAILURE
2016-11-06 21:47:41.359953		NtCreateFile	create_disposition => 2 file_handle => 0x00000344 filepath => C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF{B8CD13DD-D2C2-43C1-8E86-ABBE45AFAF43}.tmp desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF{B8CD13DD-D2C2-43C1-8E86-ABBE45AFAF43}.tmp create_options => 96 status_info => 2 share_access => 1	SUCCESS
2016-11-06 21:47:41.409953		NtCreateFile	create_disposition => 1 file_handle => 0x0000035c filepath => C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL create_options => 2144 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:41.439953		NtCreateFile	create_disposition => 1 file_handle => 0x00000374 filepath => C:\WINDOWS\system32\stdole2.tlb desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\stdole2.tlb create_options => 2144 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:41.519953		LdrLoadDll	basename => scp32 module_address => 0x0fef0000 flags => 0 module_name => scp32.dll	SUCCESS
2016-11-06 21:47:41.539953		NtOpenFile	file_handle => 0x00000368 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Local Settings\Temp\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:41.549953		NtCreateFile	create_disposition => 1 file_handle => 0x00000368 filepath => C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSO.DLL desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSO.DLL create_options => 2144 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:41.619953		NtCreateFile	create_disposition => 1 file_handle => 0x0000036c filepath => C:\WINDOWS\system32\FM20.DLL desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\FM20.DLL create_options => 2144 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:42.000953		LdrLoadDll	basename => USER32 module_address => 0x7e410000 flags => 0 module_name => USER32.DLL	SUCCESS
2016-11-06 21:47:42.010953		CoCreateInstance	class_context => 3 clsid => {ac9f2f90-e877-11ce-9f68-00aa00574a4f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:47:42.020953		NtCreateFile	create_disposition => 2 file_handle => 0x0000031c filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\~DFFF1F.tmp desired_access => 0xc0110080 file_attributes => 256 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFFF1F.tmp create_options => 4192 status_info => 2 share_access => 7	SUCCESS
2016-11-06 21:47:42.070953		NtOpenFile	file_handle => 0x00000384 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.090953		NtOpenFile	file_handle => 0x00000384 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.100953		NtOpenFile	file_handle => 0x00000384 filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.130953		NtOpenFile	file_handle => 0x00000384 filepath => C:\Documents and Settings\Administrator\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.130953		NtOpenFile	file_handle => 0x00000384 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.140953		NtOpenFile	file_handle => 0x00000384 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.230953		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL\3 desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL\3 create_options => 2144 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:42.260953		NtCreateFile	create_disposition => 1 file_handle => 0x00000384 filepath => C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL create_options => 2144 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:47:42.320953		NtCreateFile	create_disposition => 2 file_handle => 0x00000390 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\VBE desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VBE create_options => 16417 status_info => 2 share_access => 3	SUCCESS
2016-11-06 21:47:42.441953		NtOpenFile	file_handle => 0x0000039c filepath => C:\WINDOWS\system32\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.451953		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\VBE\MSForms.exd desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VBE\MSForms.exd create_options => 2144 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:47:42.461953		NtOpenFile	file_handle => 0x00000390 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.471953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.471953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.481953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\Administrator\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.491953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.501953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\VBE\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VBE\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.511953		NtOpenFile	file_handle => 0x00000390 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.521953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.531953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.531953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\Administrator\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.541953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.551953		NtOpenFile	file_handle => 0x00000390 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.561953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.561953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.581953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\Administrator\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.581953		NtOpenFile	file_handle => 0x00000390 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.591953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.601953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\Administrator\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ADMINI~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.611953		NtOpenFile	file_handle => 0x00000390 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.621953		NtOpenFile	file_handle => 0x00000390 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.621953		NtOpenFile	file_handle => 0x00000390 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:47:42.691953		NtCreateFile	create_disposition => 5 file_handle => 0x00000390 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\VBE\MSForms.exd desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VBE\MSForms.exd create_options => 96 status_info => 2 share_access => 0	SUCCESS
2016-11-06 21:47:42.691953		NtWriteFile	buffer => MSFT file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.711953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.721953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.721953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.731953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.741953		NtWriteFile	buffer => Q file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.751953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.751953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.761953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.771953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.771953		NtWriteFile	buffer => ‘ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.781953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.791953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.801953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.801953		NtWriteFile	buffer => ³ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.811953		NtWriteFile	buffer => # file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.821953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.821953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.831953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.841953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.841953		NtWriteFile	buffer => € file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.851953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.861953		NtWriteFile	buffer => ¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.861953		NtWriteFile	buffer => dÈ,  ô X¼ „èL°xÜ@¤lÐ4˜ü` Ä ( Œ ð T¸€äH ¬ tØ< hÌ0”ø\À$ˆìP´|àD¨pÔ8œdÈ,ôX¼ „èL°xÜ@¤ l Ð 4!˜!ü!`"Ä"(#Œ#ð#T$¸$%€%ä%H&¬&'t'Ø'<( ()h)Ì)0*”*ø*\+À+$,ˆ,ì,P-´-.|.à.D/¨/0p0Ô081œ12d2È2,33ô3X4¼4 5„5è5L6°67x7Ü7@8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.871953		NtWriteFile	buffer => ÿÿÿÿl¤8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.881953		NtWriteFile	buffer => ÿÿÿÿ Ð file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.891953		NtWriteFile	buffer => ÿÿÿÿ$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.891953		NtWriteFile	buffer => ÿÿÿÿÐ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.901953		NtWriteFile	buffer => ÿÿÿÿ€ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.911953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.921953		NtWriteFile	buffer => ÿÿÿÿÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.931953		NtWriteFile	buffer => ÿÿÿÿxxG file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.931953		NtWriteFile	buffer => ÿÿÿÿT file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.941953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.951953		NtWriteFile	buffer => ÿÿÿÿÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.961953		NtWriteFile	buffer => ÿÿÿÿ  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.961953		NtWriteFile	buffer => ÿÿÿÿÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.971953		NtWriteFile	buffer => ÿÿÿÿÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.981953		NtWriteFile	buffer => ÿÿÿÿÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:42.991953		NtWriteFile	buffer => &!ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ€èÁÿÿÿÿ&! ÿÿÿÿÿÿÿÿ0,ÿÿÿÿÿÿÿÿ€¸]"ÿÿÿÿ¦ÿÿÿÿÿÿÿÿHDÿÿÿÿÿÿÿÿ€`0ÿÿÿÿ#!ÿÿÿÿ @¨s! è-˜r! s!`@`ÿÿÿÿÿÿÿÿ d ˜0ÿÿÿÿ$!ÿÿÿÿ  ` ¨Pr!m!ˆ+xPtÿÿÿÿÿÿÿÿ ÿÿÿÿ84ÿÿÿÿ !ÿÿÿÿа@,8~!€~!„ÿÿÿÿÞ­ÿÿÿÿÿÿÿÿx5ÿÿÿÿ !ÿÿÿÿаÅ!X! !¨œÿÿÿÿþ«ÿÿÿÿÿÿÿÿ°5ÿÿÿÿ$!ÿÿÿÿ°8n!€n!Èn!ÀP°ÿÿÿÿ~†ÿÿÿÿ 8ÿÿÿÿè5ÿÿÿÿ$!ÿÿÿÿ8¶ p!Øp! q!ؐPÌÿÿÿÿø„ÿÿÿÿ $ÿÿÿÿè<ÿÿÿÿ$! ÿÿÿÿ8>! Ðq!¼`¼ðPèÿÿÿÿî„ÿÿÿÿ $ÿÿÿÿ =ÿÿÿÿ$! ÿÿÿÿ8D! ¨¼ð¼8½ P ÿÿÿÿä„ÿÿÿÿ $ÿÿÿÿ`?ÿÿÿÿ$!ÿÿÿÿ8@ €½Ƚ¾ P ÿÿÿÿR ÿÿÿÿ $ÿÿÿÿ˜?ÿÿÿÿ$!ÿÿÿÿ8F °P!øP!@Q!8 P< ÿÿÿÿž„ÿÿÿÿ $ÿÿÿÿÐ?ÿÿÿÿ%! ÿÿÿÿÿÿÿÿP X ÿÿÿÿø„ÿÿÿÿ @ÿÿÿÿ%!ÿÿÿÿÿÿÿÿh t ÿÿÿÿî„ÿÿÿÿ @@ÿÿÿÿ%!ÿÿÿÿÿÿÿÿ€  ÿÿÿÿä„ÿÿÿÿ  x@ÿÿÿÿ%!ÿÿÿÿÿÿÿÿ˜ ¨ ÿÿÿÿR ÿÿÿÿ 0°@ÿÿÿÿ%!ÿÿÿÿÿÿÿÿ° À ÿÿÿÿž„ÿÿÿÿ @ 6ÿÿÿÿ%!ÿÿÿÿÿÿÿÿÈ Ø ÿÿÿÿÿÿÿÿ P :ÿÿÿÿ !ÿÿÿÿЄðLL`L¨Là ð ÿÿÿÿö®ÿÿÿÿÿÿÿÿX:ÿÿÿÿ !ÿÿÿÿ@”ˆQ!ÈMNXNø ÿÿÿÿ¯ÿÿÿÿÿÿÿÿ:ÿÿÿÿ !ÿÿÿÿа NxOÀOÐT! ÿÿÿÿбÿÿÿÿÿÿÿÿÈ:ÿÿÿÿ !ÿÿÿÿ@ä ВU!`U!¨U!(8ÿÿÿÿb±ÿÿÿÿÿÿÿÿ;ÿÿÿÿ !ÿÿÿÿhXØ –`–¨–@Tÿÿÿÿø¬ÿÿÿÿÿÿÿÿ8;ÿÿÿÿ !ÿÿÿÿhXȗð–8—€—XhÿÿÿÿF´ÿÿÿÿÿÿÿÿp;ÿÿÿÿ !ÿÿÿÿhX™8˜€˜Șp|ÿÿÿÿž¬ÿÿÿÿÿÿÿÿ¨;ÿÿÿÿ !ÿÿÿÿЄXš€™șšˆ˜ÿÿÿÿt³ÿÿÿÿÿÿÿÿà;ÿÿÿÿ !ÿÿÿÿhXœ0›x›À› °ÿÿÿÿ0¬ÿÿÿÿÿÿÿÿ<ÿÿÿÿ !ÿÿÿÿаPxœÀœ¸ÈÿÿÿÿÿÿÿÿÿÿÿÿP<ÿÿÿÿ !ÿÿÿÿhXŸ(žpž¸žÐàÿÿÿÿN¬ÿÿÿÿÿÿÿÿˆ<ÿÿÿÿ !ÿÿÿÿhX0€!pŸ¸Ÿè!èøÿÿÿÿÿÿÿÿÿÿÿÿxRÿÿÿÿ !ÿÿÿÿ  Œ x!  €!è€!0!ÿÿÿÿÿÿÿÿÿÿÿÿXSÿÿÿÿ ! ÿÿÿÿhX€‰!¨ˆ!ðˆ!8‰!0ÿÿÿÿ(´ÿÿÿÿÿÿÿÿSÿÿÿÿ !!ÿÿÿÿЄȊ!ð‰!8Š!€Š!0Tÿÿÿÿ’®ÿÿÿÿÿÿÿÿÈSÿÿÿÿ !"ÿÿÿÿ  ÜxŒ! ‹!è‹!0Œ!HpÿÿÿÿÀ²ÿÿÿÿÿÿÿÿËÿÿÿÿ !#ÿÿÿÿЄøŽ! Ž!hŽ!°Ž!`Œÿÿÿÿ„­ÿÿÿÿÿÿÿÿHËÿÿÿÿ !$ÿÿÿÿЄè##X# #x¤ÿÿÿÿ:±ÿÿÿÿÿÿÿÿ€Ëÿÿÿÿ !%ÿÿÿÿ  ÜЏ!À ##P#Äÿÿÿÿr°ÿÿÿÿÿÿÿÿ¸Ëÿÿÿÿ$!&ÿÿÿÿ  !FP¸;#p›!¨Päÿÿÿÿÿÿÿÿ  ÿÿÿÿðËÿÿÿÿ$!'ÿÿÿÿ @# ¸#°}!X#ÀPøÿÿÿÿÿÿÿÿ pÿÿÿÿ(Ìÿÿÿÿ$!(ÿÿÿÿ0 °™#bpðŒ(‹¨ #ØPÿÿÿÿÿÿÿÿ ˆ ÿÿÿÿ`Ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.001953		NtWriteFile	buffer => È øà ð(x@И è˜ h Àˆ ˆ° X@(ø  ˆÀà P ¸Ø file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.011953		NtWriteFile	buffer => uÓ)­M/Õ"ÓÒ9)þÿÿÿÿÿÿÿ CPf¾‹»ª0«CPf¾‹»ª0«dÿÿÿÿCPf¾‹»ª0«Èÿÿÿÿàö¾t¨‹ºª0«, ÿÿÿÿàö¾t¨‹ºª0« ÿÿÿÿ G»—÷ιìªkiô ÿÿÿÿàW—÷ιìªkiXÿÿÿÿõrìuóιèªki¼ÿÿÿÿp#°‚¼µÏ Ét ÿÿÿÿq#°‚¼µÏ Ét„Àr#°‚¼µÏ Étèÿÿÿÿ<hŠ„ºÏ ÉtLؑ<hŠ„ºÏ Ét°ðs#°‚¼µÏ Étÿÿÿÿt#°‚¼µÏ Étxÿÿÿÿu#°‚¼µÏ ÉtÜÿÿÿÿ’<hŠ„ºÏ Ét@ “<hŠ„ºÏ Ét¤P B;AôιêªkiÿÿÿÿPÒ;ƪ¼Î¶MªLÖØlÿÿÿÿø1Yº˜œk‚‡Ðx^1Yº˜œk‚‡48 Àëà™ÑΌΪD»`˜ÿÿÿÿ0Ö½=sÝΌѪD»`üÈ 0<ÇΞ˜ªWJO` h \1Yº˜œk‚‡Ä ° ¬ºf*|烪K¦®( X„NGÍ_£¾¹k‚}¨Œ ÿÿÿÿ@üáßp¼ª>;)ð ˆ01û)ÁͧwÝ <WTÿÿÿÿÀtçý¨šÍ„Ûk‚‡¸ÿÿÿÿ ÷0ÁÍ›ák‚‡ Ê%ÖYÌζSªLÖ؀ÿÿÿÿðÔß+ê΀Cª` úä@b”§Eê΀Cª` úH ¨€L‚Qê΀Cª` ú¬ 0p2SéΞª`óà»t5 õ΃öªG˜FtÆYl†Ï«|ªÀÏØpǏYl†Ï«|ªÀÏ<˜ pj¸).õΛΪ`Ž  `ȏYl†Ï«|ªÀÏHS¿KšFN‹½ª>;)hÐà žÜΞ˜ªWJǪȏ[qJ—¦eÀ‹00 ”?ÏFõΛΪ`Ž ”ði*ÆÜΞ˜ªWJOøø n`ôΛͪ`Ž \8ÀTz1±ÇΚýª` ¸ÀàqåÏ‚ƒªK¦®$ÿÿÿÿÁTz1±ÇΚýª` ¸ˆÿÿÿÿÂTz1±ÇΚýª` ¸ìÿÿÿÿ%Ÿ¤!BÎŽ ªK¦®Pÿÿÿÿ$Ÿ¤!BÎŽ ªK¦®´°AŒÙŲNÎŽ ªK¦®ÿÿÿÿÀd ð{±Î©]ªl³‰| Ád ð{±Î©]ªl³‰àà ñgqj2$Ï•oªKúD˜Pµ^âö$ϦâªÀ ¨  ͌­±Î‚vªK¦®ÿÿÿÿ°"ÑçÆ΂|ªK¦®p(Ðù7œåýΕ`ªKúÔøáýÇë™h΀Àªa€8ãýÇë™h΀Àªa€œ€Ð|Mt Ï´tªn·4@ÁYl†Ï«|ªÀÏd¸ďYl†Ï«|ªÀÏÈR:s*έåªDw=,HҋBìΞ ª`ó`#ҋBìΞ ª`óôè3ҋBìΞ ª`óXxCҋBìΞ ª`ó¼SҋBìΞ ª`ó ¨cҋBìΞ ª`ó„ÀÏYl†Ï«|ªÀÏèØÃÿ‹£ ¥Îªa€Là“ÏJ”æ¡Îªa€°ÿÿÿÿYl†Ï«|ªÀÏh³oyò·Î—ïªm'vx C’YL&i™’eÆùÜÿÿÿÿÑUÆ\ύgª½Î@`ÑUÆ\ύgª½Î¤(ÑUÆ\ύgª½Î ÿÿÿÿÑUÆ\ύgª½Îl XÑUÆ\ύgª½ÎÐ ðÑUÆ\ύgª½Î4!ÑUÆ\ύgª½Î˜!ÑUÆ\ύgª½Îü!@#ÑUÆ\ύgª½Î`"x%ÑUÆ\ύgª½ÎÄ""žŒ—°Ôο-ª?@Ð(#à#žŒ—°Ôο-ª?@Ќ#Á{l¯ÎŸFªWJOð#È@2×iÎͧwÝ <WT$XҋBìΞ ª`ó¸$ÿÿÿÿҋBìΞ ª`ó%ÿÿÿÿ"ҋBìΞ ª`ó€%8 ҋBìΞ ª`óä%P2ҋBìΞ ª`óH&è0ҋBìΞ ª`ó¬& BҋBìΞ ª`ó' RҋBìΞ ª`ót'H bҋBìΞ ª`óØ'x @ҋBìΞ ª`ó<(0 PҋBìΞ ª`ó (` `ҋBìΞ ª`ó)À ¯NÚιCªh‡´h)PÂ{l¯ÎŸFªWJOÌ) àÑß/^ΤIªJ€=0*¸Ç{l¯ÎŸFªWJO”*Ø °åêbJξ֪a€ø* ²oyò·Î—ïªm'v\+˜°oyò·Î—ïªm'vÀ+°¥’YL&i™’eÆù$,pA’YL&i™’eÆùˆ,ØPÖnyé_ύhª½Îì,ÐàÿG˜aÏŒèªl³‰P-h áÿG˜aÏŒèªl³‰´-ðâÿG˜aÏŒèªl³‰.° ãÿG˜aÏŒèªl³‰|.8 äÿG˜aÏŒèªl³‰à.€åÿG˜aÏŒèªl³‰D/P æÿG˜aÏŒèªl³‰¨/È èÿG˜aÏŒèªl³‰00éÿG˜aÏŒèªl³‰p0€ ÑUÆ\ύgª½ÎÔ0hÑUÆ\ύgª½Î81èÑUÆ\ύgª½Îœ1¸ÑUÆ\ύgª½Î2 ÑUÆ\ύgª½Îd2¨ ÑUÆ\ύgª½ÎÈ2ð ÑUÆ\ύgª½Î,3ÐÑUÆ\ύgª½Î3ÿÿÿÿ"ÑUÆ\ύgª½Îô3H$ÑUÆ\ύgª½ÎX4 @ŸäVé΁Aªa€¼4ÈVï\=q΀ɪa€ 5 á’Xs΀˪a€„5`ɏYl†Ï«|ªÀÏè5ø È{l¯ÎŸFªWJOL6ppãFz?ξ֪a€°6€ Vï\=q΀ɪa€7¨Âd ð{±Î©]ªl³‰x7 ŸhÃ1ÂΣªJ=<Ü78 ŸhÃ1ÂΣªJ==@8€ 0ÀFpÀF 0ÀF H ø{2¿‹»ª0«5 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.011953		NtWriteFile	buffer =>  ÿÿÿÿÿÿÿÿ„ ÿÿÿÿÿÿÿÿè ÿÿÿÿÿÿÿÿL ÿÿÿÿÿÿÿÿ° ÿÿÿÿÿÿÿÿ¼ ÿÿÿÿÿÿÿÿØ ÿÿÿÿphÿÿÿÿÿÿÿÿ ÿÿÿÿ0ÿÿÿÿÿÿÿÿ  ÿÿÿÿ°”ÿÿÿÿÿÿÿÿd ÿÿÿÿÐ(#ÿÿÿÿÿÿÿÿÈ ÿÿÿÿðð#ÿÿÿÿÿÿÿÿ ÿÿÿÿ ¸$ÿÿÿÿÿÿÿÿô ÿÿÿÿ0 €%ÿÿÿÿÿÿÿÿX ÿÿÿÿP H&ÿÿÿÿÿÿÿÿ¼ ÿÿÿÿp 'ÿÿÿÿÿÿÿÿ  ÿÿÿÿ t'ÿÿÿÿÿÿÿÿ„ ÿÿÿÿ° Ø'ÿÿÿÿÿÿÿÿ ÿÿÿÿÐ  ÿÿÿÿÿÿÿÿè ÿÿÿÿð Ì)ÿÿÿÿÿÿÿÿ ÿÿÿÿ”*ÿÿÿÿÿÿÿÿx ÿÿÿÿ0\+ÿÿÿÿÿÿÿÿÜ ÿÿÿÿP$,ÿÿÿÿÿÿÿÿ@ ÿÿÿÿpì,ÿÿÿÿÿÿÿÿ¤ ÿÿÿÿP-ÿÿÿÿÿÿÿÿ ÿÿÿÿ°´-ÿÿÿÿÿÿÿÿl ÿÿÿÿÐ.ÿÿÿÿÿÿÿÿÐ ÿÿÿÿð|.ÿÿÿÿÿÿÿÿ4! ÿÿÿÿà.ÿÿÿÿÿÿÿÿ˜! ÿÿÿÿ0D/ÿÿÿÿÿÿÿÿü! ÿÿÿÿP¨/ÿÿÿÿÿÿÿÿ`" ÿÿÿÿp0ÿÿÿÿÿÿÿÿÄ" ÿÿÿÿp0ÿÿÿÿÿÿÿÿè5 ÿÿÿÿ°L6ÿÿÿÿÿÿÿÿ 5 ÿÿÿÿÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.021953		NtWriteFile	buffer => È à                             ! " # $ % & ' ( ) * + , - . / ø 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~  €  ‚ ƒ „  † ‡ ˆ ‰ Š ‹ Œ  Ž   ‘ ’ “ ” • – — ˜ ™ š › œ  ž Ÿ   ¡ ¢ £ ¤ ¥ ¦ § ¨ © ª « ¬ ­ ® ¯ ° ± ² ³ ´ µ ¶ · ¸ ¹ º »  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.031953		NtWriteFile	buffer => ° -stdole2.tlbWWW file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.041953		NtWriteFile	buffer => ?H"è-4GpEì9„+äB¸>HE.XGÈ)XFüCô:¬?ð!D9ÐDÔCÔ@Ô; $Ø9¤7¬AÐ54C¤DCœ@ FG¸-°=@8B¨;8=À? B$E0A 0 >˜EèAHC&L-8+p/@?@>ø1t(>Ì8”'øBX>°Cˆ<$F¼7€;\C¤6ô? C´5ÜEH7Ð>ˆ>X9h7ÀEðF|%°8ø4ì@è7>Ä'B*lAt&Ü30:49,.X<d6„BPA8Ft8d@¼<)|D€9€1ì8à0ÈF4@œC(D@ð;;x'Œ-p>4´+d2Fà= =|F$& file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.041953		NtWriteFile	buffer => ÿÿÿÿÿÿÿÿCMSFormsWÿÿÿÿ 8äõOLE_COLORWWWdÿÿÿÿ 8(oOLE_HANDLEWWÈÿÿÿÿ8ÂWOLE_OPTEXCLUSIVE, ÿÿÿÿ8ŸÎIFontWWW ÿÿÿÿ(UFontô ÿÿÿÿ8©*fmDropEffectXÿÿÿÿ8ŒbfmAction¼ÿÿÿÿ8kIDataAutoWrapper ÿÿÿÿ8ÜVIReturnIntegerWW„ÿÿÿÿ8à9IReturnBooleanWWèÿÿÿÿ 8³IReturnStringWWWLÿÿÿÿ 88LIReturnSingleWWW°ÿÿÿÿ 8|IReturnEffectWWWÿÿÿÿ 8å‚ReturnIntegerWWWxÿÿÿÿ 8éeReturnBooleanWWWÜ,8¨ÛReturnString@ÿÿÿÿ8ÞtReturnSingle¤ÿÿÿÿ8"HReturnEffectÿÿÿÿ 8šDataObjectWWlÿÿÿÿ8.fmModeWWÐœ8£fmMousePointerWW4ÿÿÿÿ8wlfmScrollBars˜ÿÿÿÿ8! fmScrollActionWWüÿÿÿÿ8*|fmCycleW` ÿÿÿÿ8PÉfmZOrderÄ ÿÿÿÿ 8]9fmBorderStyleWWW( ÿÿÿÿ8j?fmTextAlignWŒ ÿÿÿÿ8o fmAlignmentWð ð 8™ñfmBordersWWWTÿÿÿÿ8< fmBackStyleW¸ÿÿÿÿ 8tÆfmButtonStyleWWWt 8éfmPicPositionWWW€|8]þfmVerticalScrollBarSideWäÿÿÿÿ8¥ÑfmLayoutEffectWWH ÿÿÿÿ8öäfmSpecialEffectW¬ ÿÿÿÿ8¤ñfmDragStateWÿÿÿÿ8—fmPictureSizeModeWWWtÿÿÿÿ8ÖfmPictureAlignmentWWØÿÿÿÿ8G©IControl<ÿÿÿÿ(ÌKControls ÿÿÿÿ8ٌIOptionFrameÿÿÿÿ 8¬ˆ_UserFormWWWhÿÿÿÿ 8:tControlEventsWWWÌÿÿÿÿ8ˆ²ControlW0 8iÛFormEventsWW”ÿÿÿÿ8fëOptionFrameEventsWWWøÿÿÿÿ8NUserForm\ÿÿÿÿ8ÊFrameWWWÀÿÿÿÿ8ÿfmButtonEffectWW$¨ 8^õfmOrientationWWWˆ8äKfmSnapPointWì8YˆfmPicturePositionWWWP< 8ü–fmDisplayStyleWW´ÿÿÿÿ8À·fmShowListWhenWWD8B}fmShowDropButtonWhen|ÿÿÿÿ 8SHfmMultiSelectWWWàÿÿÿÿ8TÊfmListStyleWDÿÿÿÿ8ìøfmEnterFieldBehavior¨°8T_fmDragBehaviorWWÌ8CfmMatchEntrypÿÿÿÿ8uŠfmDropButtonStyleWWWԐ 8(5fmStyleW8X8ˆfmTabOrientationœÿÿÿÿ 8•êfmTabStyleWWŒ 8$8fmIMEModeWWWdÿÿÿÿ 8Á9ILabelControlWWWÈÿÿÿÿ8bÒICommandButtonWW,ÿÿÿÿ8œrPIROWSETl8•”IMdcTextôÿÿÿÿ8Ò{IMdcListXÿÿÿÿ 8/IMdcComboWWW¼ÿÿÿÿ8kÔIMdcCheckBox ”8SìIMdcOptionButton„T8%àIMdcToggleButtonèÿÿÿÿ 81ÒIScrollbarWWL88!ØTabW°ÿÿÿÿ(Z“Tabsÿÿÿÿ 8ÍVITabStripWWWxX8@ISpinbuttonWÜt8UàIImageWW@T8*ØIWHTMLSubmitButtonWW¤X 8åIWHTMLImageW 8¸eIWHTMLResetWl ø8tGIWHTMLCheckboxWWÐ ÿÿÿÿ8“éIWHTMLOption4!ÿÿÿÿ 8H÷IWHTMLTextWW˜!ÿÿÿÿ8nÖIWHTMLHiddenü!ÿÿÿÿ8ûšIWHTMLPasswordWW`"°8M«IWHTMLSelectÄ"°8ogIWHTMLTextAreaWW(#`8LabelControlEventsWWŒ#È8aLabelWWWð#p8ö#CommandButtonEventsWT$( 8kþCommandButtonWWW¸$ 8ÙYMdcTextEventsWWW%¸8ÊQTextBoxW€%ÿÿÿÿ 8óMdcListEventsWWWä% 8™äListBoxWH&ÿÿÿÿ8EMdcComboEventsWW¬&ÿÿÿÿ8·\ComboBox'L 8kmMdcCheckBoxEventsWWWt'ÿÿÿÿ8zMdcOptionButtonEventsWWWØ'è8ÞìMdcToggleButtonEventsWWW<(l8i{CheckBox (ÿÿÿÿ8¾ãOptionButton)ÿÿÿÿ8×ToggleButtonh)ä8Ç4NewFontWÌ)ÿÿÿÿ8’ScrollbarEventsW0* 8eËScrollBarWWW”*8õ@TabStripEventsWWø*¤ 8GÓTabStrip\+ì 8õWSpinbuttonEventsÀ+  8ÚrSpinButtonWW$,˜ 8s@ImageEventsWˆ,8êImageWWWì,x8ÈWHTMLControlEventsWWP- 8ØWHTMLControlEvents1W´-ÿÿÿÿ8ØWHTMLControlEvents2W.ÿÿÿÿ8ØWHTMLControlEvents3W|.ÿÿÿÿ8ØWHTMLControlEvents4Wà.ÿÿÿÿ8ØWHTMLControlEvents5WD/ÿÿÿÿ8ØWHTMLControlEvents6W¨/P8ØWHTMLControlEvents7W0ÿÿÿÿ8 ØWHTMLControlEvents9Wp0œ8AÜWHTMLControlEvents10Ô0ÿÿÿÿ 8p*HTMLSubmitWW81¤ 8×HTMLImageWWWœ1ô 8*HTMLResetWWW2ÿÿÿÿ8¦4HTMLCheckboxd2ÿÿÿÿ 8ßÇHTMLOptionWWÈ28Ã7HTMLText,3ÿÿÿÿ 8;ÄHTMLHiddenWW3ÿÿÿÿ8®—HTMLPasswordô3Ø 8™HTMLSelectWWX4À 8"dHTMLTextArea¼48uÁfmTransitionEffectWW 5h 8Y;IPageWWW„5`(“ÃPagesWWWè5Ô 8áIMultiPageWWL6ÿÿÿÿ8®MultiPageEventsW°6ø 8ÌéMultiPageWWW7¤8N}Pagex7„ 8JúfmListBoxStylesWÜ7L8ÊÏfmRepeatDirectionWWW@88dfmEnAutoSize, ¼ðòNameÿÿÿÿ8Z®pnameWWW, îûSizeÿÿÿÿÿÿÿÿX·psizeWWW, ¼ƒùBoldÿÿÿÿÿÿÿÿí´pboldWWW, !ItalicWWÿÿÿÿH ;þpitalicW, P óÉUnderlineWWWÿÿÿÿÔ X”punderlineWW,  "ÜStrikethroughWWWÿÿÿÿÿÿÿÿhjpstrikethroughWW, x1ÉWeightWWÿÿÿÿÿÿÿÿ‹›pweightW, ÿÿÿÿQ#CharsetWÿÿÿÿÿÿÿÿ'pcharset, ¸ ’<hFontWWW file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.051953		NtWriteFile	buffer => "Microsoft Forms 2.0 Object LibraryC:\WINDOWS\system32\fm20.hlpWWNoneWWCopyWWMoveWW CopyOrMoveCutWWWPasteWDragDropWWInheritWWWOnWWWWOffWWWDefaultWWWArrowWCrossWIBeamWSizeNESWWWSizeNSSizeNWSEWWSizeWEUpArrowWWW HourGlassWNoDropAppStartingWWWHelpWWSizeAllWWWCustom HorizontalVerticalWWBothWWNoChangeWWLineUpLineDownWWPageUpPageDownWWBeginWEndWWWAbsoluteChangePropertyChangeControlRequestFocusRequestWWAllFormsWWCurrentFormWWWFrontWBackWWSingleLeftWWCenterRightWBoxWWWTopWWWTransparentWWWOpaque PushButtonToggleButtonWWTopLeftWWW TopCenterWTopRightWW CenterLeftCenterRightWWW BottomLeftBottomCenterWWBottomRightWWWInitiateWWRespondWWWFlatWWRaisedSunkenEtchedBumpWWEnterWLeaveWOverWWClipWWStretchWWWZoomWWAutoWWLeftTopWWW LeftCenter LeftBottomRightTopWWRightCenterWWWRightBottomWWW AboveLeftWAboveCenterWWW AboveRight BelowLeftWBelowCenterWWW BelowRightTextWWListWWComboWCheckBoxWWOptionButtonWWToggleDropListWWNeverWButtonFocusWAlwaysMultiWExtendedWWPlainWOption SelectAllWRecallSelectionWWWDisabledWWEnabledWWWFirstLetterWWWCompleteWWEllipsisWWReduce DropDownComboWDropDownListWWBottomTabsWWButtonsWWW NoControlWDisableWWWHiraganaWWKatakanaWWKatakanaHalfWW AlphaFullWAlphaW HangulFullHangul HanziFullWHanziWCoverUpWWWCoverRightUpWW CoverRightCoverRightDown CoverDownW CoverLeftDownW CoverLeftWCoverLeftUpWWWPushUp PushRightWPushDownWWPushLeftWWListBoxWWWComboBoxWW file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.061953		NtWriteFile	buffer => @€@€@€@€ÿdÿ ÿ, ÿ0ÿ8ÿÿH@€þX@€ÿ%ÿp@€þ€@€ÿ1ÿ˜ÿ=ÿ¨@€ÿIÿÀô ÿUÿØÿaÿèÿmÿøÿyÿ ÿ ÿ ÿ‘ÿ( ÿÿ8 ÿ©ÿH ÿµÿX ÿÁÿh ÿÍÿx ÿÙÿˆ ÿåÿ˜ ÿñÿ¨ ÿýÿ¸ ÿ ÿÈ ÿ ÿØ ÿ! ÿè ÿ- ÿø ÿ9 ÿÿE ÿÿQ ÿ(ÿ] ÿ8ÿi ÿHÿu ÿXÿ ÿhÿ ÿxÿ™ ÿˆÿ¥ ÿ˜ÿ± ÿ¨ä` ÿ½ ÿÈÿÉ ÿØÿÕ ÿèÿá ÿøÿí ÿÿÌÿÿxÿ(ÿù ÿ8ÿÿHÿÿXÿÿhÿ)ÿxÿÄ ÿ<ÿ˜üÿ ÿ°4ÿ5ÿÈÐtH €lÿÿ¬ ÿ¤ÿ XÿÜÿ8ÿÿH˜ÿ@ÿ`ÿAÿpÿMÿ€ÿYÿÿeÿ ÿqÿ°ÿ}ÿÀÿ‰ÿÐÿ•ÿàÿ¡ÿðÿ­ÿÿ¹ÿÿÅÿ ÿÑÿ0ÿÝÿ@ÿéÿPÿLÿ`ÿõÿpÿ ÿ€ÿ ÿÿÿ ÿ%ÿ°Tì( ÿ1ÿØÿ=ÿèÿIÿøÿUÿÿaÿÿmÿ(ÿyÿ8ÿ ÿHÿ‘ÿXÿÿhpD¨Pÿ©ÿ¨ÿµÿ¸ÿÁÿÈÿÍÿØÿÙÿèÿ,à|ÿåÿÿñÿ(ÿýÿ8ÿ ÿHÿÿXÔÿ!ÿpÿ-ÿ€ÿ9ÿÿEÿ ÿQÿ°Œ Àÿ]ÿÐÿiÿàÿuÿðÿÿÿÿÿ™ÿ ÿ¥ÿ0ÿ±ÿ@ÿ½ÿPÿÉÿ`ÿÕÿpÿáÿ€ÿíÿÿùÿ ÿÿ°$ÿÿÈÿÿØÿ)ÿèÿ5ÿøÿAÿ œ8ÿ°ÿ( ÿMÿ8 ÿYÿH ÿeÿX ÿqÿh ÿ}ÿx ÿ‰ÿˆ ÿ•ÿ˜ ÿ¡ÿ¨ ÿ­ÿ¸ ÿ¹ÿÈ ÿÅÿØ ÿÑÿè ÿÝÿø ÿéÿ ÿõÿ ÿ ÿ( ÿ ÿ8 ÿÿH ÿ%ÿX ÿ1ÿh ÿ=ÿx ÿIÿˆ ÿUÿ˜ ÿaÿ¨ ÿmÿ¸ ÿyÿÈ ÿ ÿØ ÿ‘ÿè ÿÿø ÿ©ÿÿµÿÿÁÿ(ÿÍÿ8ÿÙÿHÿåÿXÿñÿhÿýÿxÿ ÿˆÿÿ˜ÿ!ÿ¨ÿ-ÿ¸ÿ9ÿÈÿEÿØÿQÿèÿ]ÿøÿiÿÿuÿÿÿ(ÿÿ8ÿ™ÿHÿ¥ÿXÿ±ÿhÿ½ÿxÿÉÿˆÿÕÿ˜ÿáÿ¨ÿíÿ¸ÿùÿÈÿÿØÿÿèÿÿøÿ)ÿ ÿ5ÿ ÿAÿ( ÿMÿ8 ¼4ÿYÿP ÿeÿ` ÿqÿp ÿ}ÿ€ ÿ‰ÿ ÿ7ÿ  ÿ•ÿ° ÿ¡ÿÀ ÿ­ÿÐ ÿ¹ÿà ÿÅÿð ÿ„5ÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.072953		NtWriteFile	buffer => þÿÿÿWWÿÿÿÿWW file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.082953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.082953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.092953		NtWriteFile	buffer => €LD file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.102953		NtWriteFile	buffer => ° file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.112953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.122953		NtWriteFile	buffer => €D! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.122953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.132953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.142953		NtWriteFile	buffer => €LD file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.142953		NtWriteFile	buffer => Ô file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.152953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.162953		NtWriteFile	buffer => €D! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.172953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.172953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.182953		NtWriteFile	buffer => €LD file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.192953		NtWriteFile	buffer => ø file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.202953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.212953		NtWriteFile	buffer => € D! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.212953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.222953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.232953		NtWriteFile	buffer => €$LD file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.242953		NtWriteFile	buffer =>   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.242953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.252953		NtWriteFile	buffer => €(D! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.262953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.272953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.272953		NtWriteFile	buffer => €,LD file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.282953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.292953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.302953		NtWriteFile	buffer => €0D! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.302953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.312953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.322953		NtWriteFile	buffer => €4LD file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.332953		NtWriteFile	buffer => € file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.332953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.342953		NtWriteFile	buffer => €8D! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.352953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.362953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.362953		NtWriteFile	buffer => €<LD file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.372953		NtWriteFile	buffer => ° file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.382953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.382953		NtWriteFile	buffer => €@D! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.392953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.402953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.412953		NtWriteFile	buffer => €DLD file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.412953		NtWriteFile	buffer => Ø file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.422953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.432953		NtWriteFile	buffer => €HD! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.442953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.442953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.452953		NtWriteFile	buffer => €LLD file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.462953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.462953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.472953		NtWriteFile	buffer => €PT  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.482953		NtWriteFile	buffer => @( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.492953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.502953		NtWriteFile	buffer => €TL  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.502953		NtWriteFile	buffer => 8P file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.512953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.522953		NtWriteFile	buffer => €XT  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.522953		NtWriteFile	buffer => €| €” file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.532953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.542953		NtWriteFile	buffer => €\D  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.552953		NtWriteFile	buffer => ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.552953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.562953		NtWriteFile	buffer => €`D  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.572953		NtWriteFile	buffer => ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.582953		NtWriteFile	buffer =>  ` ` ` ` ` ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.582953		NtWriteFile	buffer =>   ÄÄèè44ddœœÄÄì<h¬Ä file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.592953		NtWriteFile	buffer => $Hl´Øü D h Œ ° Ô ø @dˆ¬Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.602953		NtWriteFile	buffer =>   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.612953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.612953		NtWriteFile	buffer => €$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.622953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.632953		NtWriteFile	buffer => €$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.632953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.642953		NtWriteFile	buffer => €$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.652953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.662953		NtWriteFile	buffer => €$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.662953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.672953		NtWriteFile	buffer => €$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.682953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.692953		NtWriteFile	buffer => €$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.692953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.702953		NtWriteFile	buffer => €$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.712953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.712953		NtWriteFile	buffer => €$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.722953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.732953		NtWriteFile	buffer =>  Äè4dœÄ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.732953		NtWriteFile	buffer => (<PdxΠfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.742953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.742953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.752953		NtWriteFile	buffer => €4Œ®D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.763953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.763953		NtWriteFile	buffer => €4 Œè­L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.773953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.773953		NtWriteFile	buffer => €4Œü­T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.843953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.883953		NtWriteFile	buffer => €4Œò­\ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.933953		NtWriteFile	buffer => @ @@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.933953		NtWriteFile	buffer => Üø0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:43.993953		NtWriteFile	buffer => 8T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.013953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.023953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.033953		NtWriteFile	buffer => €4Œ¬h file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.043953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.053953		NtWriteFile	buffer => €4 Œ¬L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.053953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.063953		NtWriteFile	buffer => €4Œ&¬p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.073953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.073953		NtWriteFile	buffer => €4Œ¬x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.083953		NtWriteFile	buffer => @ @@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.083953		NtWriteFile	buffer => Tl„  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.093953		NtWriteFile	buffer => 8T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.103953		NtWriteFile	buffer => Πfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.103953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.113953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.123953		NtWriteFile	buffer => PØ `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.123953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.133953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.143953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.143953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.153953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.163953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.163953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.173953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.183953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.193953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.193953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.203953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.203953		NtWriteFile	buffer => xØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.213953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.223953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.223953		NtWriteFile	buffer => €  Ø €€ €, °@ ¸XÈphˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.233953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.233953		NtWriteFile	buffer => €4Ž  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.243953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.253953		NtWriteFile	buffer => € D –´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.263953		NtWriteFile	buffer => €È file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.263953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.273953		NtWriteFile	buffer => €$D  ´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.283953		NtWriteFile	buffer => €È file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.283953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.293953		NtWriteFile	buffer => €(T  ª´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.303953		NtWriteFile	buffer => € €È file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.303953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.313953		NtWriteFile	buffer => €,4´´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.323953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.323953		NtWriteFile	buffer => €04¾´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.333953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.343953		NtWriteFile	buffer => Ð4D 8† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.353953		NtWriteFile	buffer => €d file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.353953		NtWriteFile	buffer => ` `` ` ` ` `` `````` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.363953		NtWriteFile	buffer => ¼ü$T¤œ°Üð0L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.363953		NtWriteFile	buffer => 0H`„À Œ ¨ Ð ø ,Hd file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.373953		NtWriteFile	buffer => Ð file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.383953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.383953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.393953		NtWriteFile	buffer => àØ `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.403953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.403953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.413953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.423953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.433953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.433953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.443953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.443953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.453953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.464953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.464953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.474953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.484953		NtWriteFile	buffer => ðØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.484953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.494953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.504953		NtWriteFile	buffer => € Ø €€ €,  @ ¸X phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.504953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.514953		NtWriteFile	buffer => €D$  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.524953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.524953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.534953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.544953		NtWriteFile	buffer => ` `` ` ` ` ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.544953		NtWriteFile	buffer => ¼ü$T¤xx file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.554953		NtWriteFile	buffer => 0H`„À Œ ´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.564953		NtWriteFile	buffer => Ð file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.564953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.574953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.584953		NtWriteFile	buffer => 0 Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.584953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.594953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.604953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.604953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.614953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.624953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.624953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.634953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.644953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.644953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.654953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.654953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.664953		NtWriteFile	buffer => @ Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.674953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.674953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.684953		NtWriteFile	buffer => € P Ø €€ €, ` @ ¸Xp phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.694953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.694953		NtWriteFile	buffer => €D$  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.704953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.714953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.714953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.724953		NtWriteFile	buffer => ` `` ` ` ` ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.734953		NtWriteFile	buffer => ¼ü$T¤xx file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.734953		NtWriteFile	buffer => 0H`„À Œ ´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.744953		NtWriteFile	buffer => Ð file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.754953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.754953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.764953		NtWriteFile	buffer => € Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.774953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.774953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.794953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.794953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.804953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.814953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.824953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.824953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.834953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.844953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.844953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.854953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.864953		NtWriteFile	buffer =>  Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.874953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.874953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.884953		NtWriteFile	buffer => €   Ø €€ €, ° @ ¸XÀ phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.894953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.894953		NtWriteFile	buffer => €D$  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.904953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.914953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.914953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.944953		NtWriteFile	buffer => ` `` ` ` ` ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.954953		NtWriteFile	buffer => ¼ü$T¤xx file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.964953		NtWriteFile	buffer => 0H`„À Œ ´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.964953		NtWriteFile	buffer => Ð file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.974953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.994953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:44.994953		NtWriteFile	buffer => Ð Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.004953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.014953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.034953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.094953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.195953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.205953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.225953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.235953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.245953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.255953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.275953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.275953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.285953		NtWriteFile	buffer => à Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.295953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.295953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.305953		NtWriteFile	buffer => € ð Ø €€ €, @ ¸Xphˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.315953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.315953		NtWriteFile	buffer => €D$  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.325953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.335953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.335953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.345953		NtWriteFile	buffer => ` `` ` ` ` ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.355953		NtWriteFile	buffer => ¼ü$T¤xx file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.365953		NtWriteFile	buffer => 0H`„À Œ ´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.365953		NtWriteFile	buffer => Ð file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.375953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.385953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.385953		NtWriteFile	buffer => Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.395953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.405953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.405953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.415953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.425953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.425953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.435953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.435953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.445953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.455953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.455953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.465953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.475953		NtWriteFile	buffer => 0Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.485953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.485953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.495953		NtWriteFile	buffer => € @Ø €€ €, P@ ¸X`phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.505953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.505953		NtWriteFile	buffer => €D$  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.515953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.525953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.525953		NtWriteFile	buffer => Ð 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.535953		NtWriteFile	buffer => ` `` ` ` ` ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.545953		NtWriteFile	buffer => ¼ü$T¤xx file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.545953		NtWriteFile	buffer => 0H`„À Œ ´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.555953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.555953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.565953		NtWriteFile	buffer => €4¯„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.575953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.575953		NtWriteFile	buffer => €4¯ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.585953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.595953		NtWriteFile	buffer => €4Œ ¯˜ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.595953		NtWriteFile	buffer => @ @@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.605953		NtWriteFile	buffer => Œ¨¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.615953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.615953		NtWriteFile	buffer => ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.625953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.635953		NtWriteFile	buffer => €4ŒP¯  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.635953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.645953		NtWriteFile	buffer => €4 Œ2¯¬ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.655953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.655953		NtWriteFile	buffer => €4Œ<¯´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.665953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.675953		NtWriteFile	buffer => €4Œn¯¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.675953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.685953		NtWriteFile	buffer => €4ŒŒ¯Ä file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.695953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.695953		NtWriteFile	buffer => €4Œ–¯Ð file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.705953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.715953		NtWriteFile	buffer => €4Œ ¯Ø file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.715953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.725953		NtWriteFile	buffer => €4 Œª¯ä file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.735953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.735953		NtWriteFile	buffer => €4 Œ´¯ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.745953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.755953		NtWriteFile	buffer => €4Œd¯ø file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.755953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.765953		NtWriteFile	buffer => €4Œx¯ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.765953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.775953		NtWriteFile	buffer => €4 Œ(¯ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.785953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.795953		NtWriteFile	buffer => €4ŒZ¯ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.795953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.805953		NtWriteFile	buffer => €4Œ‚¯$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.815953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.856953		NtWriteFile	buffer => €4cŒF¯0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.866953		NtWriteFile	buffer => @ @@@@@@@@ @ @@@ @@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.866953		NtWriteFile	buffer => Ôø8X|œÀà(Hp´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.876953		NtWriteFile	buffer => 8TpŒ¨Äàü 4 P l ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.886953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.906953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.916953		NtWriteFile	buffer => €4Œî±D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.916953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.926953		NtWriteFile	buffer => €4 Œä±8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.936953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.936953		NtWriteFile	buffer => €4Œø±D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.946953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.956953		NtWriteFile	buffer => €4ŒÚ±P file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.956953		NtWriteFile	buffer => @ @@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.966953		NtWriteFile	buffer => Ôð4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.976953		NtWriteFile	buffer => 8T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.976953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.986953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.996953		NtWriteFile	buffer => €4Œ¨±X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:45.996953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.006953		NtWriteFile	buffer => €4 Œž±d file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.006953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.016953		NtWriteFile	buffer => €4Œ”±l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.026953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.026953		NtWriteFile	buffer => €4Œ¼±x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.036953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.046953		NtWriteFile	buffer => €4Œ²±€ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.046953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.056953		NtWriteFile	buffer => €4Œl±Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.066953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.066953		NtWriteFile	buffer => €4Œ€±” file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.076953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.086953		NtWriteFile	buffer => €4Œœ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.086953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.096953		NtWriteFile	buffer => €4ŒÆ±¬ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.106953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.106953		NtWriteFile	buffer => €4 Œv±¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.116953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.126953		NtWriteFile	buffer => €4 ŒŠ±Ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.126953		NtWriteFile	buffer => @ @@@@@@@@ @ @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.136953		NtWriteFile	buffer => Pt”¸Øü<h¸ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.146953		NtWriteFile	buffer => 8TpŒ¨Äàü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.146953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.156953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.166953		NtWriteFile	buffer => €4Œ­Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.166953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.176953		NtWriteFile	buffer => €4Œ­è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.186953		NtWriteFile	buffer => @ @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.186953		NtWriteFile	buffer => àü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.196953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.196953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.206953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.216953		NtWriteFile	buffer => €4ŒZ´ø file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.216953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.226953		NtWriteFile	buffer => €4 ŒP´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.236953		NtWriteFile	buffer => @ @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.246953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.246953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.256953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.256953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.346953		NtWriteFile	buffer => €4Œ¨¬D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.386953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.486953		NtWriteFile	buffer => €4 Œ²¬ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.506953		NtWriteFile	buffer => @ @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.506953		NtWriteFile	buffer => Pp file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.516953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.526953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.536953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.536953		NtWriteFile	buffer => €4 Œˆ³ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.547953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.547953		NtWriteFile	buffer => €4Œ~³ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.557953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.567953		NtWriteFile	buffer => €4Œ’³  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.567953		NtWriteFile	buffer => @ @@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.577953		NtWriteFile	buffer => ¬Ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.587953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.597953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.607953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.617953		NtWriteFile	buffer => €4Œ:¬ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.617953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.627953		NtWriteFile	buffer => €4 ŒD¬  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.637953		NtWriteFile	buffer => @ @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.647953		NtWriteFile	buffer => è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.657953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.657953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.667953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.677953		NtWriteFile	buffer => €4ŒŠ¬D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.687953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.687953		NtWriteFile	buffer => €4 Œv¬( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.697953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.707953		NtWriteFile	buffer => €4Œ€¬ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.717953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.727953		NtWriteFile	buffer => €4Œ”¬0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.737953		NtWriteFile	buffer => @ @@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.737953		NtWriteFile	buffer => <Tp file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.747953		NtWriteFile	buffer => 8T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.757953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.757953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.767953		NtWriteFile	buffer => €4Œb¬8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.777953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.777953		NtWriteFile	buffer => €4 ŒX¬H file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.787953		NtWriteFile	buffer => @ @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.797953		NtWriteFile	buffer => ˆ¬ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.797953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.817953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.817953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.827953		NtWriteFile	buffer => €4Œä¬P file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.937953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.957953		NtWriteFile	buffer => €4 Œî¬\ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.967953		NtWriteFile	buffer => @ @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.967953		NtWriteFile	buffer => Ìð file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.977953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.987953		NtWriteFile	buffer => ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.987953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:46.997953		NtWriteFile	buffer => €4Œ6° file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.027953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.027953		NtWriteFile	buffer => €4 Œ^°l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.037953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.047953		NtWriteFile	buffer => €4ŒT°x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.047953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.057953		NtWriteFile	buffer => €4Œh°„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.067953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.067953		NtWriteFile	buffer => €4Œ@° file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.077953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.087953		NtWriteFile	buffer => €4ŒJ°œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.087953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.097953		NtWriteFile	buffer => €4Œ"°¬ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.097953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.107953		NtWriteFile	buffer => €4Œ°¸ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.117953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.117953		NtWriteFile	buffer => €4Œ,°È file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.127953		NtWriteFile	buffer => @ @@@@@@@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.137953		NtWriteFile	buffer => 8X| Äè4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.157953		NtWriteFile	buffer => 8TpŒ¨Äà file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.157953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.167953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.177953		NtWriteFile	buffer => €4Œ<´  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.177953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.187953		NtWriteFile	buffer => €4 Œ2´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.197953		NtWriteFile	buffer => @ @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.197953		NtWriteFile	buffer => X€ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.207953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.217953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.217953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.227953		NtWriteFile	buffer => €4Œ¦®D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.237953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.237953		NtWriteFile	buffer => €4 Œœ®Ø file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.248953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.258953		NtWriteFile	buffer => €4Œä file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.258953		NtWriteFile	buffer => @ @@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.268953		NtWriteFile	buffer => ¨Èì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.278953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.278953		NtWriteFile	buffer => Πfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.288953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.298953		NtWriteFile	buffer => €4ŒÞ²ð file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.298953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.308953		NtWriteFile	buffer => €4 Œè²ø file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.308953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.318953		NtWriteFile	buffer => €4Œò² file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.338953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.348953		NtWriteFile	buffer => €4ŒÔ² file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.348953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.358953		NtWriteFile	buffer => €4ŒÊ² file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.368953		NtWriteFile	buffer => @ @@@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.368953		NtWriteFile	buffer => 0Txœ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.378953		NtWriteFile	buffer => 8Tp file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.388953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.388953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.398953		NtWriteFile	buffer => €4ŒŽ­ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.408953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.408953		NtWriteFile	buffer => €4 Œ˜­  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.418953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.418953		NtWriteFile	buffer => €4Œ¢­( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.428953		NtWriteFile	buffer => @ @@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.438953		NtWriteFile	buffer => ¼Øô file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.438953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.448953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.458953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.458953		NtWriteFile	buffer => €4ŒD±0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.468953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.478953		NtWriteFile	buffer => €4 ŒN±8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.478953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.488953		NtWriteFile	buffer => €4ŒX±D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.498953		NtWriteFile	buffer => @ @@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.498953		NtWriteFile	buffer => 4X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.508953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.508953		NtWriteFile	buffer => Πfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.518953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.528953		NtWriteFile	buffer => €4Œš°l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.528953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.538953		NtWriteFile	buffer => €4 Œ¤°„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.538953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.548953		NtWriteFile	buffer => €4Œ° file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.558953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.568953		NtWriteFile	buffer => €4Œ|°¬ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.568953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.578953		NtWriteFile	buffer => €4Œ†°È file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.578953		NtWriteFile	buffer => @ @@@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.588953		NtWriteFile	buffer => |¤Ìð file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.598953		NtWriteFile	buffer => 8Tp file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.598953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.608953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.608953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.618953		NtWriteFile	buffer => pØ `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.628953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.628953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.638953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.638953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.648953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.658953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.668953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.668953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.678953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.678953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.688953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.698953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.698953		NtWriteFile	buffer => €Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.708953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.718953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.718953		NtWriteFile	buffer => € Ø €€ €,  @ ¸X°phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.728953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.738953		NtWriteFile	buffer => €D$ ȇ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.738953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.748953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.758953		NtWriteFile	buffer => € 4ȇ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.768953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.768953		NtWriteFile	buffer => €$D$ Tˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.778953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.888953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.898953		NtWriteFile	buffer => €(4 Tˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.908953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.918953		NtWriteFile	buffer => €,D$ ^ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.918953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.928953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.939953		NtWriteFile	buffer => €04^ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.939953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.949953		NtWriteFile	buffer => €4D$ ®ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.959953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.959953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.969953		NtWriteFile	buffer => €84 ®ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.979953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.979953		NtWriteFile	buffer => €<D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.989953		NtWriteFile	buffer => €¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.999953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:47.999953		NtWriteFile	buffer => €@L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.009953		NtWriteFile	buffer => ¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.019953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.019953		NtWriteFile	buffer => €DD$ b‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.029953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.029953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.039953		NtWriteFile	buffer => €H4b‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.049953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.059953		NtWriteFile	buffer => €LD$ l‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.059953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.069953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.079953		NtWriteFile	buffer => €P4l‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.079953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.089953		NtWriteFile	buffer => €@TD$ Š‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.099953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.099953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.109953		NtWriteFile	buffer => €@X4Š‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.119953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.129953		NtWriteFile	buffer => ¸\4ډ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.129953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.139953		NtWriteFile	buffer => €`D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.149953		NtWriteFile	buffer => €H file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.149953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.159953		NtWriteFile	buffer => €dL file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.169953		NtWriteFile	buffer => H  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.169953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.179953		NtWriteFile	buffer => €hD$ ä‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.179953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.189953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.199953		NtWriteFile	buffer => €l4ä‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.209953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.209953		NtWriteFile	buffer => €pD$ ¶Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.219953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.229953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.229953		NtWriteFile	buffer => €t4¶Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.239953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.249953		NtWriteFile	buffer => €xL file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.249953		NtWriteFile	buffer => ˆ  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.259953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.269953		NtWriteFile	buffer => €|4Ԋ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.269953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.279953		NtWriteFile	buffer => €€L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.289953		NtWriteFile	buffer => ¸  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.299953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.299953		NtWriteFile	buffer => !€„4!ފ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.309953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.309953		NtWriteFile	buffer => "€ˆL" file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.319953		NtWriteFile	buffer => ä  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.329953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.329953		NtWriteFile	buffer => #€Œ4#èŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.339953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.349953		NtWriteFile	buffer => $€L$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.349953		NtWriteFile	buffer => ! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.359953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.369953		NtWriteFile	buffer => %€”4%òŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.369953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.379953		NtWriteFile	buffer => & €˜4&ʊ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.389953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.389953		NtWriteFile	buffer => ' €œ4'‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.399953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.399953		NtWriteFile	buffer => (€ D$) `‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.409953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.419953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.419953		NtWriteFile	buffer => )€¤4(`‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.429953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.429953		NtWriteFile	buffer => *€¨D$+ j‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.439953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.439953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.449953		NtWriteFile	buffer => +€¬4*j‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.459953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.459953		NtWriteFile	buffer => ,ۡD$- ZΠfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.469953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.469953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.479953		NtWriteFile	buffer => -۫4,ZΠfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.489953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.489953		NtWriteFile	buffer => .€¸D$/ ‚Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.499953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.499953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.509953		NtWriteFile	buffer => /€¼4.‚Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.519953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.519953		NtWriteFile	buffer => 0€ÀD$1 ŒŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.529953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.539953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.539953		NtWriteFile	buffer => 1€Ä40ŒŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.549953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.549953		NtWriteFile	buffer => 2€ÈD2 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.559953		NtWriteFile	buffer => €Ì! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.569953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.569953		NtWriteFile	buffer => 3€ÌL3 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.579953		NtWriteFile	buffer => Ì! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.579953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.589953		NtWriteFile	buffer => 4€ÐD$5 ¾Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.599953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.599953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.609953		NtWriteFile	buffer => 5€Ô44¾Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.609953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.619953		NtWriteFile	buffer => 6€TØL$7  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.630953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.630953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.640953		NtWriteFile	buffer => 7€TÜ46 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.640953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.650953		NtWriteFile	buffer => 8€àD$9  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.660953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.660953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.670953		NtWriteFile	buffer => 9€ä48 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.670953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.680953		NtWriteFile	buffer => :ۏD: file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.690953		NtWriteFile	buffer => €4" file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.690953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.700953		NtWriteFile	buffer => ;ۓL; file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.710953		NtWriteFile	buffer => 4" file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.710953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.720953		NtWriteFile	buffer => <€ðD$= , file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.730953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.730953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.740953		NtWriteFile	buffer => =€ô4<, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.750953		NtWriteFile	buffer => X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.760953		NtWriteFile	buffer => >€ø„>À  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.760953		NtWriteFile	buffer => €H €Ì!€4"€¼€p" file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.770953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.780953		NtWriteFile	buffer => ?€üD? L† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.780953		NtWriteFile	buffer => €˜" file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.840953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.880953		NtWriteFile	buffer => @€@ D@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:48.990953		NtWriteFile	buffer => ۀ" file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.010953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.020953		NtWriteFile	buffer => A€ 4A.† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.040953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.040953		NtWriteFile	buffer => B€ 4B file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.060953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.070953		NtWriteFile	buffer => C€ 4C file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.090953		NtWriteFile	buffer => H file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.100953		NtWriteFile	buffer => D€ tD file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.110953		NtWriteFile	buffer => €H €Ì! €4" €¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.130953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.140953		NtWriteFile	buffer => E€ DE file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.140953		NtWriteFile	buffer => À˜" file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.160953		NtWriteFile	buffer => ` `` ` ` ` `8 €8 € € € € €E €E €7 €7 €` ` € €2 €2 €€ €€ €€ €`` € € € €`€ €`€ €`€ €`€ € € € €€ €€ €€ €€ € € € € € € €+`,` € €€ €€ € € €3`4` € € € € € €;`<`=`>` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.170953		NtWriteFile	buffer => ¼ü$T¤DDXXtt¤Ð¼¼èè   4 X H H   l ˆ   ¸ Ì ä ø !$!8!L!L!d!d!€!€!”!”!¨!¨!¸!Ü!Ì!Ì!ð!ð!"""H"4"4"`"„"°"à"ô"##0# file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.170953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <X€œÀä(Pl”°Ìð<X€œÀÜ@\€œ¸Ôü@\„ Èä(Lp˜´Üø <`„¬È H l ˆ   ¸ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.180953		NtWriteFile	buffer => D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.190953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.200953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.210953		NtWriteFile	buffer => ÐØ `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.220953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.230953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.240953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.240953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.250953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.260953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.270953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.280953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.280953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.290953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.300953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.300953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.310953		NtWriteFile	buffer => àØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.320953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.331953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.331953		NtWriteFile	buffer => € ðØ €€ €, @ ¸Xphˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.341953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.351953		NtWriteFile	buffer => €4hˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.361953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.361953		NtWriteFile	buffer =>  € 4ÀŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.371953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.381953		NtWriteFile	buffer => €$D ¶  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.381953		NtWriteFile	buffer => €|# file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.391953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.401953		NtWriteFile	buffer => €(4 Ž  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.401953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.411953		NtWriteFile	buffer => €,T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.421953		NtWriteFile	buffer => €Œ# €œ# file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.421953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.431953		NtWriteFile	buffer => €@04 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.441953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.441953		NtWriteFile	buffer => 4T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.451953		NtWriteFile	buffer => Ü# file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.461953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.461953		NtWriteFile	buffer => €@84 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.471953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.481953		NtWriteFile	buffer => €@<4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.491953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.491953		NtWriteFile	buffer => €@@4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.501953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.511953		NtWriteFile	buffer => €@D4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.511953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.521953		NtWriteFile	buffer => €@H4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.531953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.531953		NtWriteFile	buffer =>  €L4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.541953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.551953		NtWriteFile	buffer =>  PL file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.551953		NtWriteFile	buffer => €„$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.561953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.561953		NtWriteFile	buffer =>  TL file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.571953		NtWriteFile	buffer => €´$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.581953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.581953		NtWriteFile	buffer =>  XL file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.591953		NtWriteFile	buffer => ۆ$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.601953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.601953		NtWriteFile	buffer => €\4t† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.611953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.621953		NtWriteFile	buffer => €`4t† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.631953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.631953		NtWriteFile	buffer => €dTÀ  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.641953		NtWriteFile	buffer => €Œ# €œ# file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.641953		NtWriteFile	buffer => @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.651953		NtWriteFile	buffer =>  hlz  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.661953		NtWriteFile	buffer => €,% € €" file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.661953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.671953		NtWriteFile	buffer => €lD è  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.681953		NtWriteFile	buffer => €|# file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.681953		NtWriteFile	buffer => ` `` ` ` ` `<üÿÿÿ>`A``` ` ``` `````?BC file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.691953		NtWriteFile	buffer => ¼ü$T¤D#X#l#œ#¬#Ä#ð#$ $8$H$X$h$˜$Ä$ì$%`"%D% file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.701953		NtWriteFile	buffer => 0H`„À Œ ¨ Ä ì 8PtŒ¤¼Ôì(LpŒ¨Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.701953		NtWriteFile	buffer => € file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.711953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.721953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.721953		NtWriteFile	buffer => xØ `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.731953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.731953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.741953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.751953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.761953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.761953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.771953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.771953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.781953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.971953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.981953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:49.991953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.001953		NtWriteFile	buffer => ˆØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.011953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.011953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.022953		NtWriteFile	buffer => € ˜Ø €€ €, ¨@ ¸X¸phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.032953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.042953		NtWriteFile	buffer =>  <<‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.052953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.052953		NtWriteFile	buffer => € D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.062953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.062953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.072953		NtWriteFile	buffer => ˆ$4‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.082953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.082953		NtWriteFile	buffer => €(D$  ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.092953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.102953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.102953		NtWriteFile	buffer => ˆ,4  ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.112953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.122953		NtWriteFile	buffer => €0D$ ´‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.122953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.132953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.142953		NtWriteFile	buffer => 44´‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.142953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.152953		NtWriteFile	buffer => €84҇ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.162953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.162953		NtWriteFile	buffer => €<4܇ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.172953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.182953		NtWriteFile	buffer => €@4æ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.192953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.192953		NtWriteFile	buffer => €DD$ ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.202953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.212953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.212953		NtWriteFile	buffer => €H4ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.222953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.232953		NtWriteFile	buffer =>  L<Jˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.232953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.242953		NtWriteFile	buffer => €PD$ ¤ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.252953		NtWriteFile	buffer => ¨ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.252953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.262953		NtWriteFile	buffer => ¨T4¤ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.272953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.272953		NtWriteFile	buffer => €XD$ àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.282953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.282953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.292953		NtWriteFile	buffer => €\4àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.302953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.312953		NtWriteFile	buffer => €D`L$ ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.312953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.322953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.332953		NtWriteFile	buffer => €dLD ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.332953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.342953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.352953		NtWriteFile	buffer => ¸h<ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.352953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.362953		NtWriteFile	buffer => €lD$ D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.362953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.372953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.382953		NtWriteFile	buffer => ˆp4D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.382953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.392953		NtWriteFile	buffer => €tL file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.402953		NtWriteFile	buffer => Ø& file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.402953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.412953		NtWriteFile	buffer => €x4”‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.422953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.422953		NtWriteFile	buffer => €|L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.432953		NtWriteFile	buffer => ' file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.442953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.442953		NtWriteFile	buffer => €€4 ž‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.452953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.462953		NtWriteFile	buffer => !€„D$" Ɖ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.462953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.472953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.482953		NtWriteFile	buffer => "Àˆ4!Ɖ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.482953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.492953		NtWriteFile	buffer => #€ŒL$$ „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.502953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.502953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.512953		NtWriteFile	buffer => $€LD% „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.522953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.532953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.532953		NtWriteFile	buffer => %Д<#„Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.542953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.552953		NtWriteFile	buffer => &€˜D$' ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.552953		NtWriteFile	buffer => Øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.562953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.572953		NtWriteFile	buffer => 'Øœ4&ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.572953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.582953		NtWriteFile	buffer => (€ D$) $‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.592953		NtWriteFile	buffer => àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.602953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.602953		NtWriteFile	buffer => )à¤4($‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.612953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.622953		NtWriteFile	buffer => *€¨L$+ .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.622953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.632953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.632953		NtWriteFile	buffer => +€¬LD, .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.642953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.652953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.652953		NtWriteFile	buffer => ,а<*.‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.662953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.672953		NtWriteFile	buffer => -€´D$. B‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.672953		NtWriteFile	buffer => èÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.682953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.692953		NtWriteFile	buffer => .è¸4-B‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.692953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.702953		NtWriteFile	buffer => /€¼D$0 L‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.712953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.712953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.723953		NtWriteFile	buffer => 0€À4/L‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.733953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.733953		NtWriteFile	buffer => 1€ÄD$2 t‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.743953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.753953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.753953		NtWriteFile	buffer => 2ÀÈ41t‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.763953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.773953		NtWriteFile	buffer => 3€ÌD3 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.773953		NtWriteFile	buffer => €( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:50.783953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.806953		NtWriteFile	buffer => 4€ÐL4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.816953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.826953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.836953		NtWriteFile	buffer => 5€ÔD$6 ~‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.836953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.846953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.856953		NtWriteFile	buffer => 6€Ø45~‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.866953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.876953		NtWriteFile	buffer => 7ۆD7 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.876953		NtWriteFile	buffer => €d( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.886953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.886953		NtWriteFile	buffer => 8ۈL8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.896953		NtWriteFile	buffer => d( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.906953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.906953		NtWriteFile	buffer => 9€äD$: ˆ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.916953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.926953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.936953		NtWriteFile	buffer => :€è49ˆ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.946953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.946953		NtWriteFile	buffer => ;ۓD; file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.956953		NtWriteFile	buffer => €´( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.956953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.966953		NtWriteFile	buffer => <€ðL< file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.976953		NtWriteFile	buffer => ´( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.976953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.986953		NtWriteFile	buffer => =€ôD$> ’‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:52.996953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.006953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.016953		NtWriteFile	buffer => >€ø4=’‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.016953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.026953		NtWriteFile	buffer => ?۟D? file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.026953		NtWriteFile	buffer => €) file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.036953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.046953		NtWriteFile	buffer => @€ L@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.046953		NtWriteFile	buffer => ) file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.056953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.066953		NtWriteFile	buffer => A€ D$B œ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.066953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.076953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.076953		NtWriteFile	buffer => B€ 4Aœ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.086953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.096953		NtWriteFile	buffer => C @ <C¦‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.096953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.106953		NtWriteFile	buffer => D€ D$E (Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.116953		NtWriteFile	buffer => ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.116953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.126953		NtWriteFile	buffer => Eð 4D(Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.136953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.136953		NtWriteFile	buffer => F€ D$G  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.146953		NtWriteFile	buffer => øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.156953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.166953		NtWriteFile	buffer => Gø 4F file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.166953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.176953		NtWriteFile	buffer => H€ D$I @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.186953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.186953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.196953		NtWriteFile	buffer => I€$ 4H@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.206953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.206953		NtWriteFile	buffer => J€( 4J˜  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.216953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.226953		NtWriteFile	buffer => K€, 4K¢  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.236953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.246953		NtWriteFile	buffer => L€0 4LÊ  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.246953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.256953		NtWriteFile	buffer => M€4 4MÔ  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.266953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.266953		NtWriteFile	buffer => N€8 4Nü  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.276953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.286953		NtWriteFile	buffer => O€< TO† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.286953		NtWriteFile	buffer => €ð)€* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.296953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.306953		NtWriteFile	buffer => P€@ 4P$† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.306953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.316953		NtWriteFile	buffer => Q€D 4QB† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.326953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.336953		NtWriteFile	buffer => R€TH D$S ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.336953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.346953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.356953		NtWriteFile	buffer => STL 4Rˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.356953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.366953		NtWriteFile	buffer => T€TP D$U file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.376953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.376953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.386953		NtWriteFile	buffer => UTT 4T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.396953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.396953		NtWriteFile	buffer => V€TX D$W ö‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.406953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.416953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.416953		NtWriteFile	buffer => WT\ 4Vö‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.426953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.436953		NtWriteFile	buffer => X€T` D$Y Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.436953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.446953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.456953		NtWriteFile	buffer => YTd 4XΠfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.456953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.466953		NtWriteFile	buffer => Z€Th D$[ N‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.476953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.486953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.486953		NtWriteFile	buffer => [€Tl 4ZN‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.496953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.507953		NtWriteFile	buffer => \€p D\ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.507953		NtWriteFile	buffer => €°* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.517953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.527953		NtWriteFile	buffer => ]€t L] file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.527953		NtWriteFile	buffer => °* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.537953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.547953		NtWriteFile	buffer => ^€Tx D$_ X‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.547953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.557953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.567953		NtWriteFile	buffer => _€T| 4^X‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.567953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.577953		NtWriteFile	buffer => `€€ D` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.587953		NtWriteFile	buffer => €ô* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.587953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.597953		NtWriteFile	buffer => a€„ La file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.607953		NtWriteFile	buffer => ô* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.607953		NtWriteFile	buffer => ` `` ` ` ` ` þÿÿþÿÿ þÿÿ þÿÿþÿÿþÿÿ   úýÿÿúýÿÿ  þýÿÿþýÿÿÿýÿþÿÿþÿÿÿýÿÿÿýÿÿ` `   öýÿÿöýÿÿöýÿÿ÷ýÿÿ÷ýÿÿõýÿÿõýÿÿõýÿÿ ,`-` 0`1`  4`5`  8`9`       € €   ‚ ‚ ƒ ƒ „ „ U`V` Y`Z` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.617953		NtWriteFile	buffer => ¼ü$T¤¬%È%È%à%à%ø%ø%&$&8&L&L&ø`&`&t&t&ˆ&tt¤&¤&¼&Ø&ð&'$'$'H'H'H'`'`'x'x'”'”'”'¨'¨'Ä'Ä'à'à'ø',(((H(|(d(d(˜(Ì(´(´(è()))8)L)L)h)h)Œ)Œ)8$H$œ)°)È)Ü)*8*P*P*h*h*€*€*˜*˜*°*°*Ä*Ü*ô*ô*+ + file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.627953		NtWriteFile	buffer => 0H`„À Œ ¨ Ð ì 0Xt¬Èð(Pl”°ØD`„ Äà$Lt¸Ôü@h„¬Èð4Pt˜ÀÜ$LhŒ°Øô < d € œ Ä à  $ L h „   ¼ Ø ô (D`ˆ¤Èà$Lh¬Ðô 8 \ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.627953		NtWriteFile	buffer => Ä file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.637953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.647953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.647953		NtWriteFile	buffer => @Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.657953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.667953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.667953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.677953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.687953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.687953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.697953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.707953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.707953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.717953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.717953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.727953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.727953		NtWriteFile	buffer => PØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.737953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.747953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.747953		NtWriteFile	buffer => € `Ø €€ €, p@ ¸X€phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.757953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.757953		NtWriteFile	buffer =>  <<‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.767953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.767953		NtWriteFile	buffer => € D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.777953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.787953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.787953		NtWriteFile	buffer => ˆ$4‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.797953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.797953		NtWriteFile	buffer => €(D$  ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.807953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.817953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.817953		NtWriteFile	buffer => ˆ,4  ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.827953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.837953		NtWriteFile	buffer => €0D$ ´‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.837953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.847953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.847953		NtWriteFile	buffer => 44´‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.857953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.867953		NtWriteFile	buffer => €84҇ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.867953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.877953		NtWriteFile	buffer => €<4܇ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.887953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.887953		NtWriteFile	buffer => €@4æ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.897953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.897953		NtWriteFile	buffer => €DD$ ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.907953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.917953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.917953		NtWriteFile	buffer => €H4ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.927953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.937953		NtWriteFile	buffer =>  L<Jˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.937953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.947953		NtWriteFile	buffer => €PD$ ¤ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.967953		NtWriteFile	buffer => ¨ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.967953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.977953		NtWriteFile	buffer => ¨T4¤ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.987953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.987953		NtWriteFile	buffer => €XD$ àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:53.997953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.007953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.007953		NtWriteFile	buffer => €\4àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.017953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.027953		NtWriteFile	buffer => €D`L$ ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.027953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.037953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.047953		NtWriteFile	buffer => €dLD ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.047953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.057953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.067953		NtWriteFile	buffer => ¸h<ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.067953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.077953		NtWriteFile	buffer => €lD$ D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.087953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.087953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.097953		NtWriteFile	buffer => ˆp4D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.107953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.107953		NtWriteFile	buffer => €tL file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.117953		NtWriteFile	buffer => Ø& file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.127953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.127953		NtWriteFile	buffer => €x4”‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.137953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.147953		NtWriteFile	buffer => €|L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.157953		NtWriteFile	buffer => ' file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.167953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.167953		NtWriteFile	buffer => €€4 ž‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.177953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.187953		NtWriteFile	buffer => !€„D$" Ɖ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.187953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.198953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.208953		NtWriteFile	buffer => "Àˆ4!Ɖ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.208953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.218953		NtWriteFile	buffer => #€ŒL$$ „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.228953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.228953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.238953		NtWriteFile	buffer => $€LD% „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.248953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.248953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.258953		NtWriteFile	buffer => %Д<#„Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.268953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.268953		NtWriteFile	buffer => &€˜D$' ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.278953		NtWriteFile	buffer => Øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.288953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.288953		NtWriteFile	buffer => 'Øœ4&ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.298953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.308953		NtWriteFile	buffer => (€ D$) $‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.308953		NtWriteFile	buffer => àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.318953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.328953		NtWriteFile	buffer => )à¤4($‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.338953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.338953		NtWriteFile	buffer => *€¨L$+ .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.348953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.358953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.358953		NtWriteFile	buffer => +€¬LD, .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.368953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.368953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.378953		NtWriteFile	buffer => ,а<*.‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.388953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.398953		NtWriteFile	buffer => -€´D$. B‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.398953		NtWriteFile	buffer => èÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.408953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.408953		NtWriteFile	buffer => .è¸4-B‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.418953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.428953		NtWriteFile	buffer => /€¼D$0 L‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.438953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.438953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.448953		NtWriteFile	buffer => 0€À4/L‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.458953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.458953		NtWriteFile	buffer => 1€ÄD$2 t‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.468953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.468953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.478953		NtWriteFile	buffer => 2ÀÈ41t‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.488953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.498953		NtWriteFile	buffer => 3€ÌD3 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.498953		NtWriteFile	buffer => €( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.508953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.518953		NtWriteFile	buffer => 4€ÐL4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.518953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.528953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.528953		NtWriteFile	buffer => 5€ÔD$6 ~‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.538953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.548953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.548953		NtWriteFile	buffer => 6€Ø45~‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.558953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.568953		NtWriteFile	buffer => 7ۆD7 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.568953		NtWriteFile	buffer => €d( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.578953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.588953		NtWriteFile	buffer => 8ۈL8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.588953		NtWriteFile	buffer => d( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.598953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.608953		NtWriteFile	buffer => 9€äD$: ˆ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.608953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.618953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.618953		NtWriteFile	buffer => :€è49ˆ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.628953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.638953		NtWriteFile	buffer => ;ۓD; file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.638953		NtWriteFile	buffer => €´( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.648953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.658953		NtWriteFile	buffer => <€ðL< file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.658953		NtWriteFile	buffer => ´( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.668953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.678953		NtWriteFile	buffer => =€ôD$> ’‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.678953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.688953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.698953		NtWriteFile	buffer => >€ø4=’‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.698953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.708953		NtWriteFile	buffer => ?۟D? file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.718953		NtWriteFile	buffer => €) file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.718953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.728953		NtWriteFile	buffer => @€ L@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.728953		NtWriteFile	buffer => ) file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.738953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.748953		NtWriteFile	buffer => A€ D$B œ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.748953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.748953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.758953		NtWriteFile	buffer => B€ 4Aœ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.768953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.768953		NtWriteFile	buffer => C @ <C¦‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.778953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.788953		NtWriteFile	buffer => D€ D$E (Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.788953		NtWriteFile	buffer => ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.798953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.808953		NtWriteFile	buffer => Eð 4D(Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.808953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.818953		NtWriteFile	buffer => F€ D$G  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.828953		NtWriteFile	buffer => øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.828953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.838953		NtWriteFile	buffer => Gø 4F file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.838953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.848953		NtWriteFile	buffer => H€ D$I @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.858953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.868953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.878953		NtWriteFile	buffer => I€$ 4H@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.878953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.889953		NtWriteFile	buffer => J€( 4J˜  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.889953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.899953		NtWriteFile	buffer => K€, 4K¢  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.909953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.909953		NtWriteFile	buffer => L€0 4LÊ  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.919953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.929953		NtWriteFile	buffer => M€4 4MÔ  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.929953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.939953		NtWriteFile	buffer => N€8 4Nü  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.949953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.949953		NtWriteFile	buffer => O€< TO† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.959953		NtWriteFile	buffer => €ð)€* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.959953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.969953		NtWriteFile	buffer => P€@ 4P$† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.979953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.989953		NtWriteFile	buffer => Q€D 4QB† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.999953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:54.999953		NtWriteFile	buffer => R€TH D$S ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.009953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.009953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.019953		NtWriteFile	buffer => STL 4Rˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.029953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.029953		NtWriteFile	buffer => T€TP D$U file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.039953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.039953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.049953		NtWriteFile	buffer => UTT 4T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.059953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.059953		NtWriteFile	buffer => V€TX D$W ö‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.069953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.069953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.079953		NtWriteFile	buffer => WT\ 4Vö‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.089953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.089953		NtWriteFile	buffer => X€T` D$Y Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.099953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.099953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.109953		NtWriteFile	buffer => YTd 4XΠfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.119953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.129953		NtWriteFile	buffer => Z€Th D$[ N‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.129953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.139953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.149953		NtWriteFile	buffer => [€Tl 4ZN‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.149953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.159953		NtWriteFile	buffer => \€p D\ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.169953		NtWriteFile	buffer => €°* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.169953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.179953		NtWriteFile	buffer => ]€t L] file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.189953		NtWriteFile	buffer => °* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.189953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.199953		NtWriteFile	buffer => ^€Tx D$_ X‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.209953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.209953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.219953		NtWriteFile	buffer => _€T| 4^X‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.229953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.229953		NtWriteFile	buffer => `€€ D` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.239953		NtWriteFile	buffer => €ô* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.249953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.249953		NtWriteFile	buffer => a€„ La file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.259953		NtWriteFile	buffer => ô* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.269953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.269953		NtWriteFile	buffer => b€ˆ D$c ¿ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.279953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.279953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.289953		NtWriteFile	buffer => c€Œ 4b¿ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.299953		NtWriteFile	buffer => ` `` ` ` ` ` þÿÿþÿÿ þÿÿ þÿÿþÿÿþÿÿ   úýÿÿúýÿÿ  þýÿÿþýÿÿÿýÿþÿÿþÿÿÿýÿÿÿýÿÿ` `   öýÿÿöýÿÿöýÿÿ÷ýÿÿ÷ýÿÿõýÿÿõýÿÿõýÿÿ ,`-` 0`1`  4`5`  8`9`       € €   ‚ ‚ ƒ ƒ „ „ U`V` Y`Z`‹ ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.309953		NtWriteFile	buffer => ¼ü$T¤¬%È%È%à%à%ø%ø%&$&8&L&L&ø`&`&t&t&ˆ&tt¤&¤&¼&Ø&ð&'$'$'H'H'H'`'`'x'x'”'”'”'¨'¨'Ä'Ä'à'à'ø',(((H(|(d(d(˜(Ì(´(´(è()))8)L)L)h)h)Œ)Œ)8$H$œ)°)È)Ü)*8*P*P*h*h*€*€*˜*˜*°*°*Ä*Ü*ô*ô*+ +8+8+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.309953		NtWriteFile	buffer => 0H`„À Œ ¨ Ð ì 0Xt¬Èð(Pl”°ØD`„ Äà$Lt¸Ôü@h„¬Èð4Pt˜ÀÜ$LhŒ°Øô < d € œ Ä à  $ L h „   ¼ Ø ô (D`ˆ¤Èà$Lh¬Ðô 8 \ € ¨ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.319953		NtWriteFile	buffer => ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.329953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.329953		NtWriteFile	buffer => €4î„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.339953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.349953		NtWriteFile	buffer => €L  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.349953		NtWriteFile	buffer => 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.359953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.369953		NtWriteFile	buffer => €L ²„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.369953		NtWriteFile	buffer => 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.379953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.389953		NtWriteFile	buffer => €4”„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.389953		NtWriteFile	buffer => ‚ €‚ € ‚ €‚ € file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.399953		NtWriteFile	buffer => X%l%|%”% file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.409953		NtWriteFile	buffer => Dl file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.409953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.419953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.429953		NtWriteFile	buffer => €L Š„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.429953		NtWriteFile	buffer => X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.439953		NtWriteFile	buffer => | file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.449953		NtWriteFile	buffer => €Ô ž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.449953		NtWriteFile	buffer => 0D X „+ €”+ €¤+ ´+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.459953		NtWriteFile	buffer => | file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.469953		NtWriteFile	buffer => €Ô¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.469953		NtWriteFile	buffer => 0D X 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.479953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.489953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.489953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.499953		NtWriteFile	buffer => €L Є file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.509953		NtWriteFile	buffer => 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.509953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.519953		NtWriteFile	buffer => €´ä„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.529953		NtWriteFile	buffer => €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.529953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.539953		NtWriteFile	buffer => €\ø„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.549953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.549953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.559953		NtWriteFile	buffer => €L   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.569953		NtWriteFile	buffer => P8- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.569953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.579953		NtWriteFile	buffer => € \  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.590953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.590953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.600953		NtWriteFile	buffer => €$4   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.610953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.610953		NtWriteFile	buffer => €(t *  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.620953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.630953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.630953		NtWriteFile	buffer => €,t4  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.640953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.650953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.650953		NtWriteFile	buffer => €0t>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.660953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.670953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.670953		NtWriteFile	buffer => €4L H  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.680953		NtWriteFile	buffer => X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.690953		NtWriteFile	buffer => d file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.690953		NtWriteFile	buffer => €8¤R  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.700953		NtWriteFile	buffer => XÔ- Xè- €ü- €. h,. h@. file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.700953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.710953		NtWriteFile	buffer => €<L p  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.720953		NtWriteFile	buffer => T. file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.720953		NtWriteFile	buffer => ¨ýÿÿ§ýÿÿ ýÿÿ¦ýÿÿ¥ýÿÿ¤ýÿÿ£ýÿÿ¢ýÿÿ¡ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.730953		NtWriteFile	buffer => P+h+ð+$,8,L,ü,$-L-p"`-Œ-¤-¸-Ü)Œ) file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.730953		NtWriteFile	buffer => (¤ < d Ô 0d€ÌdŒð file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.740953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.750953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.750953		NtWriteFile	buffer => €L Š„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.760953		NtWriteFile	buffer => X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.760953		NtWriteFile	buffer => | file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.770953		NtWriteFile	buffer => €Ô ž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.780953		NtWriteFile	buffer => 0D X „+ €”+ €¤+ ´+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.780953		NtWriteFile	buffer => | file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.790953		NtWriteFile	buffer => €Ô¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.790953		NtWriteFile	buffer => 0D X 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.800953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.810953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.810953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.820953		NtWriteFile	buffer => €L Є file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.830953		NtWriteFile	buffer => 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.830953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.840953		NtWriteFile	buffer => €´ä„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.840953		NtWriteFile	buffer => €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.850953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.860953		NtWriteFile	buffer => €\ø„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.860953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.870953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.880953		NtWriteFile	buffer => €L   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.880953		NtWriteFile	buffer => P8- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.890953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.890953		NtWriteFile	buffer => € \  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.900953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.910953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.910953		NtWriteFile	buffer => €$4   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.920953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.930953		NtWriteFile	buffer => €(t *  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.930953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.940953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.940953		NtWriteFile	buffer => €,t4  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.950953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.960953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.960953		NtWriteFile	buffer => €0t>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.970953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.980953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.980953		NtWriteFile	buffer => €4L H  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.990953		NtWriteFile	buffer => X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:55.990953		NtWriteFile	buffer => d file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.000953		NtWriteFile	buffer => €8¤R  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.010953		NtWriteFile	buffer => XÔ- Xè- €ü- €. h,. h@. file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.010953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.020953		NtWriteFile	buffer => €<L p  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.030953		NtWriteFile	buffer => T. file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.030953		NtWriteFile	buffer => ¨ýÿÿ§ýÿÿ ýÿÿ¦ýÿÿ¥ýÿÿ¤ýÿÿ£ýÿÿ¢ýÿÿ¡ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.040953		NtWriteFile	buffer => P+h+ð+$,8,L,ü,$-L-p"`-Œ-¤-¸-Ü)Œ) file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.040953		NtWriteFile	buffer => (¤ < d Ô 0d€ÌdŒð file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.050953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.050953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.060953		NtWriteFile	buffer => €4ŒÆ¬ð file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.070953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.070953		NtWriteFile	buffer => €4ŒÐ¬ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.080953		NtWriteFile	buffer => @ @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.090953		NtWriteFile	buffer => h.ˆ. file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.090953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.100953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.110953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.110953		NtWriteFile	buffer => €4ð¯L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.120953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.120953		NtWriteFile	buffer => €4Œ°D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.130953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.140953		NtWriteFile	buffer => €4 Œú¯8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.140953		NtWriteFile	buffer => @ @@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.150953		NtWriteFile	buffer => ¨.È.ì. file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.160953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.160953		NtWriteFile	buffer => ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.170953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.170953		NtWriteFile	buffer => €4Œ¬²l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.180953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.190953		NtWriteFile	buffer => €4 Œ¢²x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.190953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.200953		NtWriteFile	buffer => €4Œ¶²„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.200953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.210953		NtWriteFile	buffer => €4ŒŽ² file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.220953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.220953		NtWriteFile	buffer => €4Œ„² file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.230953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.240953		NtWriteFile	buffer => €4Œ˜²œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.240953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.250953		NtWriteFile	buffer => €4Œp²¬ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.250953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.260953		NtWriteFile	buffer => €4Œf²¸ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.260953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.270953		NtWriteFile	buffer => €4Œz²È file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.281953		NtWriteFile	buffer => @ @@@@@@@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.281953		NtWriteFile	buffer => /0/P/p/”/´/Ø/ü/ 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.291953		NtWriteFile	buffer => 8TpŒ¨Äà file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.291953		NtWriteFile	buffer => l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.301953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.301953		NtWriteFile	buffer => €4Œ±T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.311953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.321953		NtWriteFile	buffer => €4 Œ±` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.321953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.331953		NtWriteFile	buffer => €4Œþ°l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.331953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.341953		NtWriteFile	buffer => €4Œ0±x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.341953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.351953		NtWriteFile	buffer => €4Œ&±„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.351953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.361953		NtWriteFile	buffer => €4Œ±” file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.361953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.371953		NtWriteFile	buffer => €4ŒÂ°¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.371953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.381953		NtWriteFile	buffer => €4Œ¸°° file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.391953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.391953		NtWriteFile	buffer => €4ŒÌ°À file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.401953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.401953		NtWriteFile	buffer => €4 Œà°Ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.411953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.411953		NtWriteFile	buffer => €4 ŒÖ°Ø file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.421953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.421953		NtWriteFile	buffer => €4Œê°è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.431953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.431953		NtWriteFile	buffer => €4Œô° file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.441953		NtWriteFile	buffer => @ @@@@@@@@ @ @@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.451953		NtWriteFile	buffer => D0h00¸0à0101X1€1¨1Ð1ø1 2 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.451953		NtWriteFile	buffer => 8TpŒ¨Äàü 4 P file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.461953		NtWriteFile	buffer => Ä file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.461953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.471953		NtWriteFile	buffer => €4 ŒR­ô file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.471953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.481953		NtWriteFile	buffer => €4Œ>­ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.481953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.491953		NtWriteFile	buffer => €4Œ*­ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.491953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.501953		NtWriteFile	buffer => €4Œ ­ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.511953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.511953		NtWriteFile	buffer => €4ŒH­ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.521953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.521953		NtWriteFile	buffer => €4Œ\­( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.531953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.531953		NtWriteFile	buffer => €4Œ4­0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.541953		NtWriteFile	buffer => @ @@@@@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.551953		NtWriteFile	buffer => D2d2„2¤2È2ð23 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.551953		NtWriteFile	buffer => 8Tpά file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.561953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.561953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.571953		NtWriteFile	buffer => €4ŒR²< file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.571953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.581953		NtWriteFile	buffer => €4 Œ>²D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.581953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.591953		NtWriteFile	buffer => €4ŒH²L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.591953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.601953		NtWriteFile	buffer => €4Œ4²T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.601953		NtWriteFile	buffer => @ @@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.611953		NtWriteFile	buffer => 43T3t3”3 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.611953		NtWriteFile	buffer => 8T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.631953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.631953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.641953		NtWriteFile	buffer => €4Œ ²< file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.641953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.651953		NtWriteFile	buffer => €4 Œ²L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.651953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.661953		NtWriteFile	buffer => €4Œ²T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.671953		NtWriteFile	buffer => @ @@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.671953		NtWriteFile	buffer => ´3Ü34 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.681953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.681953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.761953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.771953		NtWriteFile	buffer => €4ŒÜ¯ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.771953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.781953		NtWriteFile	buffer => €4 ŒÒ¯\ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.781953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.791953		NtWriteFile	buffer => €4ŒÈ¯d file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.801953		NtWriteFile	buffer => @ @@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.801953		NtWriteFile	buffer => ,4L4l4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.811953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.811953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.821953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.821953		NtWriteFile	buffer => €4ŒÄ®p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.831953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.841953		NtWriteFile	buffer => €4 Œº®x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.841953		NtWriteFile	buffer => @ @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.851953		NtWriteFile	buffer => 4¬4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.851953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.861953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.861953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.871953		NtWriteFile	buffer => €4Œ$®€ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.871953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.881953		NtWriteFile	buffer => €4 Œ®Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.891953		NtWriteFile	buffer => @ @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.891953		NtWriteFile	buffer => Ì4ø4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.901953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.901953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.911953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.911953		NtWriteFile	buffer => €4Œp­  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.921953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.921953		NtWriteFile	buffer => €4 Œz­¬ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.931953		NtWriteFile	buffer => @ @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.941953		NtWriteFile	buffer => (5L5 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.941953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.951953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.951953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.961953		NtWriteFile	buffer => €4Œâ®¸ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.961953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.971953		NtWriteFile	buffer => €4 ŒØ®È file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.971953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.982953		NtWriteFile	buffer => €4Œì®D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.992953		NtWriteFile	buffer => @ @@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:56.992953		NtWriteFile	buffer => p5”5´5 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.002953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.002953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.012953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.012953		NtWriteFile	buffer => €4ŒÊ­p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.022953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.022953		NtWriteFile	buffer => €4 Œ¶­¬ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.032953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.042953		NtWriteFile	buffer => €4ŒÀ­Ô file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.042953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.052953		NtWriteFile	buffer => €4ŒÔ­à file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.052953		NtWriteFile	buffer => @ @@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.052953		NtWriteFile	buffer => Ð5ô56@6 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.062953		NtWriteFile	buffer => 8T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.072953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.082953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.082953		NtWriteFile	buffer => €4Œ³è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.092953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.102953		NtWriteFile	buffer => €4Œ³ø file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.102953		NtWriteFile	buffer => @ @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.112953		NtWriteFile	buffer => d6„6 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.122953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.122953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.132953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.142953		NtWriteFile	buffer => €4ŒB³0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.142953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.152953		NtWriteFile	buffer => €4 Œ$³ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.162953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.172953		NtWriteFile	buffer => €4Œ.³ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.172953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.182953		NtWriteFile	buffer => €4Œ8³  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.192953		NtWriteFile	buffer => @ @@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.202953		NtWriteFile	buffer => ¤6Ä6è67 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.202953		NtWriteFile	buffer => 8T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.212953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.222953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.222953		NtWriteFile	buffer => €4Œj³ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.232953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.242953		NtWriteFile	buffer => €4 ŒV³ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.242953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.252953		NtWriteFile	buffer => €4Œ`³D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.262953		NtWriteFile	buffer => @ @@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.262953		NtWriteFile	buffer => ,7H7h7 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.272953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.282953		NtWriteFile	buffer => l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.282953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.292953		NtWriteFile	buffer => €4Œt®$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.292953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.302953		NtWriteFile	buffer => €4 Œˆ® file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.312953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.322953		NtWriteFile	buffer => €4Œ~®˜ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.322953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.332953		NtWriteFile	buffer => €4ŒL®0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.342953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.352953		NtWriteFile	buffer => €4ŒV®< file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.352953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.362953		NtWriteFile	buffer => €4Œ`®H file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.372953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.372953		NtWriteFile	buffer => €4Œj®T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.382953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.392953		NtWriteFile	buffer => €4ŒB®d file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.392953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.402953		NtWriteFile	buffer => €4Œ8®p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.412953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.412953		NtWriteFile	buffer => €4 Œn´x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.422953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.432953		NtWriteFile	buffer => €4 Œd´„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.432953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.442953		NtWriteFile	buffer => €4Œn´Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.452953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.452953		NtWriteFile	buffer => €4Œd´˜ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.462953		NtWriteFile	buffer => @ @@@@@@@@ @ @@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.462953		NtWriteFile	buffer => „7¤7¼7Ô7ð7808T8t88°8Ì8ì8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.472953		NtWriteFile	buffer => 8TpŒ¨Äàü 4 P file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.482953		NtWriteFile	buffer => ˜ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.482953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.492953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.502953		NtWriteFile	buffer => xØ `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.502953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.512953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.522953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.522953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.532953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.542953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.542953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.552953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.562953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.562953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.572953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.582953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.582953		NtWriteFile	buffer => ˆØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.592953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.602953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.602953		NtWriteFile	buffer => € ˜Ø €€ €, ¨@ ¸X¸phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.612953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.622953		NtWriteFile	buffer => €D$ d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.622953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.632953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.642953		NtWriteFile	buffer => € 4d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.642953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.652953		NtWriteFile	buffer => €$D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.662953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.673953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.673953		NtWriteFile	buffer => ˆ(4 ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.683953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.693953		NtWriteFile	buffer => €,D$ Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.693953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.703953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.713953		NtWriteFile	buffer => À04Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.713953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.723953		NtWriteFile	buffer => €4D$  ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.733953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.733953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.743953		NtWriteFile	buffer => ˆ84  ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.753953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.763953		NtWriteFile	buffer => €<D$ ´‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.773953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.773953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.783953		NtWriteFile	buffer => @4´‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.793953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.793953		NtWriteFile	buffer => €DD$ ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:57.803953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.033953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.033953		NtWriteFile	buffer => €H4ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.043953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.053953		NtWriteFile	buffer => €LD$ àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.063953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.063953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.073953		NtWriteFile	buffer => €P4àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.073953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.083953		NtWriteFile	buffer => €TTL$ ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.093953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.093953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.103953		NtWriteFile	buffer => €XLD ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.103953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.113953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.123953		NtWriteFile	buffer => ¸\<ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.123953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.133953		NtWriteFile	buffer => €T`D$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.143953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.143953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.153953		NtWriteFile	buffer => €Td4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.163953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.163953		NtWriteFile	buffer => €ThD$ þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.173953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.183953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.183953		NtWriteFile	buffer => €Tl4þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.193953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.203953		NtWriteFile	buffer => €TpD$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.213953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.213953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.223953		NtWriteFile	buffer => €Tt4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.233953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.233953		NtWriteFile	buffer => €TxD$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.243953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.253953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.253953		NtWriteFile	buffer => €T|4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.263953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.273953		NtWriteFile	buffer => €T€D$! &‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.273953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.283953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.293953		NtWriteFile	buffer => !€T„4 &‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.293953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.303953		NtWriteFile	buffer => "€TˆD$# 0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.313953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.313953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.323953		NtWriteFile	buffer => #€TŒ4"0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.333953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.333953		NtWriteFile	buffer => $€D$% D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.343953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.353953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.363953		NtWriteFile	buffer => %ˆ”4$D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.363953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.374953		NtWriteFile	buffer => &€˜L$' „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.384953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.384953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.394953		NtWriteFile	buffer => '€œLD( „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.404953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.404953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.414953		NtWriteFile	buffer => (Р<&„Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.424953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.424953		NtWriteFile	buffer => )€¤D$* ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.434953		NtWriteFile	buffer => Øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.444953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.444953		NtWriteFile	buffer => *ب4)ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.454953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.464953		NtWriteFile	buffer => +€¬L$, .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.464953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.474953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.484953		NtWriteFile	buffer => ,€°LD- .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.484953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.494953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.504953		NtWriteFile	buffer => -д<+.‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.504953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.514953		NtWriteFile	buffer => .€¸D$/ 8‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.524953		NtWriteFile	buffer => Èÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.524953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.534953		NtWriteFile	buffer => /ȼ4.8‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.544953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.544953		NtWriteFile	buffer => 0€ÀD$1 (Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.554953		NtWriteFile	buffer => ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.564953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.574953		NtWriteFile	buffer => 1ðÄ40(Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.574953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.584953		NtWriteFile	buffer => 2€ÈD$3  Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.594953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.594953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.604953		NtWriteFile	buffer => 3ÐÌ42 Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.614953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.614953		NtWriteFile	buffer => 4€ÐD$5 6 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.624953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.634953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.634953		NtWriteFile	buffer => 5€Ô446 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.644953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.654953		NtWriteFile	buffer => 6€ØD$7 2‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.664953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.664953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.674953		NtWriteFile	buffer => 7€Ü462‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.684953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.694953		NtWriteFile	buffer => 8€TàD$9 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.694953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.704953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.714953		NtWriteFile	buffer => 9€Tä48 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.714953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.724953		NtWriteFile	buffer => :€@èD$; file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.734953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.734953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.744953		NtWriteFile	buffer => ;€@ì4: file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.754953		NtWriteFile	buffer => ` `` ` ` ` `þÿÿþÿÿþÿÿþÿÿ þÿÿ þÿÿ þÿÿ þÿÿþÿÿþÿÿþýÿÿþýÿÿÿýÿþÿÿþÿÿ ÿýÿÿÿýÿÿöýÿÿöýÿÿöýÿÿ÷ýÿÿ÷ýÿÿõýÿÿõýÿÿõýÿÿ èýÿÿèýÿÿáýÿÿáýÿÿúýÿÿúýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.754953		NtWriteFile	buffer => ¼ü$T¤”9”9È%È%¨9¨9à%à%ø%ø%L&L&t&t&ˆ&ttÀ9À9Ø9Ø9ì9ì9::::0:0:¤&¤&H'H'H'`'`'”'”'”'L:L:L)L)h:h:€:€:99”:”:¬:¬: file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.764953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <X€œÄà$Lh¸Ôü@\„ Èä(Pl”°ØD`ˆ°Ìô8T|˜ÀÜ D\€ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.774953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.774953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.784953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.784953		NtWriteFile	buffer => àØ `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.794953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.794953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.804953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.814953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.814953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.824953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.834953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.834953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.844953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.844953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.854953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.864953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.874953		NtWriteFile	buffer => ðØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.874953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.884953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.894953		NtWriteFile	buffer => € Ø €€ €, @ ¸X phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.894953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.904953		NtWriteFile	buffer => €D$ d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.914953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.924953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.934953		NtWriteFile	buffer => € 4d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.944953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.944953		NtWriteFile	buffer => €$D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.954953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.954953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.964953		NtWriteFile	buffer => ˆ(4 ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.964953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.974953		NtWriteFile	buffer => €,D$ Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.984953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.984953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.994953		NtWriteFile	buffer => À04Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:58.994953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.004953		NtWriteFile	buffer => €4D$ ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.014953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.014953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.024953		NtWriteFile	buffer => €84 ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.024953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.034953		NtWriteFile	buffer => €<D$ àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.044953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.044953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.054953		NtWriteFile	buffer => €@4àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.065953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.065953		NtWriteFile	buffer => €TDL$ ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.075953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.075953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.085953		NtWriteFile	buffer => €HLD ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.095953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.095953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.105953		NtWriteFile	buffer => ¸L<ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.105953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.115953		NtWriteFile	buffer => €TPD$ þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.125953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.125953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.135953		NtWriteFile	buffer => €TT4þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.145953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.155953		NtWriteFile	buffer => €TXD$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.165953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.175953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.175953		NtWriteFile	buffer => €T\4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.185953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.195953		NtWriteFile	buffer => €T`D$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.195953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.205953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.215953		NtWriteFile	buffer => €Td4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.225953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.235953		NtWriteFile	buffer => €ThD$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.245953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.245953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.255953		NtWriteFile	buffer => €Tl4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.255953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.265953		NtWriteFile	buffer => €TpD$ &‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.275953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.285953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.285953		NtWriteFile	buffer => €Tt4&‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.295953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.295953		NtWriteFile	buffer => €TxD$ 0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.305953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.315953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.315953		NtWriteFile	buffer => €T|40‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.325953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.335953		NtWriteFile	buffer => €€D$! D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.345953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.345953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.355953		NtWriteFile	buffer => !ˆ„4 D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.365953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.365953		NtWriteFile	buffer => "€ˆD$# ¼‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.375953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.375953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.385953		NtWriteFile	buffer => #€Œ4"¼‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.395953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.395953		NtWriteFile	buffer => $€D$% >Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.405953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.415953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.415953		NtWriteFile	buffer => %€”4$>Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.425953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.435953		NtWriteFile	buffer => &€˜L$' „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.435953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.445953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.455953		NtWriteFile	buffer => '€œLD( „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.455953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.465953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.465953		NtWriteFile	buffer => (Р<&„Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.475953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.485953		NtWriteFile	buffer => )€¤D$* ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.485953		NtWriteFile	buffer => Øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.495953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.505953		NtWriteFile	buffer => *ب4)ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.505953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.515953		NtWriteFile	buffer => +€¬L$, .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.525953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.525953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.535953		NtWriteFile	buffer => ,€°LD- .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.545953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.545953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.555953		NtWriteFile	buffer => -д<+.‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.565953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.565953		NtWriteFile	buffer => .€¸D$/ 8‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.575953		NtWriteFile	buffer => Èÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.585953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.585953		NtWriteFile	buffer => /ȼ4.8‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.595953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.605953		NtWriteFile	buffer => 0€ÀD$1 2‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.605953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.615953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.625953		NtWriteFile	buffer => 1€Ä402‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.625953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.635953		NtWriteFile	buffer => 2€ÈD$3 6 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.645953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.645953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.655953		NtWriteFile	buffer => 3€Ì426 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.665953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.665953		NtWriteFile	buffer => 4€TÐD$5  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.675953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.675953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.685953		NtWriteFile	buffer => 5€TÔ44 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.695953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.695953		NtWriteFile	buffer => 6€TØD$7 :‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.705953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.715953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.715953		NtWriteFile	buffer => 7€TÜ46:‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.725953		NtWriteFile	buffer => ` `` ` ` ` `þÿÿþÿÿþÿÿþÿÿ þÿÿ þÿÿúýÿÿúýÿÿþýÿÿþýÿÿÿýÿþÿÿþÿÿ ÿýÿÿÿýÿÿËË öýÿÿöýÿÿöýÿÿ÷ýÿÿ÷ýÿÿõýÿÿõýÿÿõýÿÿáýÿÿáýÿÿèýÿÿèýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.735953		NtWriteFile	buffer => ¼ü$T¤”9”9È%È%¨9¨9L&L&t&t&ˆ&ttØ9Ø9À9À9ì9ì9::::0:0:¤&¤&Ø:Ø:ô:ô:H'H'H'`'`'”'”'”'L:L:99€:€:xx”:”: file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.735953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <X€œÄà0Lt¸Ôü@\„ Èä(Pl”°ØD`ˆ°Ìô8T|˜ÀÜ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.745953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.755953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.755953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.766953		NtWriteFile	buffer => 0Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.776953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.776953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.786953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.796953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.806953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.806953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.816953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.826953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.826953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.836953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.846953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.846953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.856953		NtWriteFile	buffer => @Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.866953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.876953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.876953		NtWriteFile	buffer => € PØ €€ €, `@ ¸Xpphˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.886953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.886953		NtWriteFile	buffer => €D$ d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.896953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.906953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.906953		NtWriteFile	buffer => € 4d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.916953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.926953		NtWriteFile	buffer => €$D$ n‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.926953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.936953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.946953		NtWriteFile	buffer => €(4 n‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.946953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.956953		NtWriteFile	buffer => €,D$ x‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.956953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.966953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.966953		NtWriteFile	buffer => €04x‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.976953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.986953		NtWriteFile	buffer => €4D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:47:59.996953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.006953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.006953		NtWriteFile	buffer => ˆ84 ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.016953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.016953		NtWriteFile	buffer => €<D$ Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.026953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.046953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.046953		NtWriteFile	buffer => À@4Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.056953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.056953		NtWriteFile	buffer => €DD$  ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.066953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.076953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.076953		NtWriteFile	buffer => ˆH4 ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.086953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.086953		NtWriteFile	buffer => €LD$ ´‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.096953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.106953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.106953		NtWriteFile	buffer => P4´‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.116953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.126953		NtWriteFile	buffer => €DTD$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.126953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.136953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.146953		NtWriteFile	buffer => €DX4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.146953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.156953		NtWriteFile	buffer => €\4҇ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.166953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.166953		NtWriteFile	buffer => €`D$ rˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.176953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.186953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.186953		NtWriteFile	buffer => €d4rˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.196953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.206953		NtWriteFile	buffer => €h4|ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.206953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.216953		NtWriteFile	buffer => €@l4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.226953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.226953		NtWriteFile	buffer => €pD$ ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.236953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.246953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.256953		NtWriteFile	buffer => €t4ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.256953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.266953		NtWriteFile	buffer => €@xD$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.276953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.276953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.286953		NtWriteFile	buffer => €@|4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.296953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.296953		NtWriteFile	buffer => €D€D$! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.306953		NtWriteFile	buffer => xÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.316953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.316953		NtWriteFile	buffer => !xD„4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.326953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.336953		NtWriteFile	buffer => "€ˆD$# êˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.346953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.346953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.356953		NtWriteFile	buffer => #€Œ4"êˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.366953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.366953		NtWriteFile	buffer => $€D$% àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.376953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.386953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.386953		NtWriteFile	buffer => %€”4$àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.396953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.406953		NtWriteFile	buffer => &€D˜L$& ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.406953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.416953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.426953		NtWriteFile	buffer => '€œLD( ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.426953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.436953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.446953		NtWriteFile	buffer => (¸ <'ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.446953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.457953		NtWriteFile	buffer => )€D¤D$* þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.467953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.467953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.477953		NtWriteFile	buffer => *€D¨4)þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.487953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.487953		NtWriteFile	buffer => +€D¬D$, ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.497953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.507953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.507953		NtWriteFile	buffer => ,€D°4+‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.517953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.527953		NtWriteFile	buffer => -€D´D$. ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.527953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.537953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.547953		NtWriteFile	buffer => .€D¸4-‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.557953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.557953		NtWriteFile	buffer => /€D¼D$0 ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.567953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.577953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.577953		NtWriteFile	buffer => 0€DÀ4/‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.587953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.597953		NtWriteFile	buffer => 1€DÄD$2 &‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.597953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.607953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.607953		NtWriteFile	buffer => 2€DÈ41&‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.617953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.627953		NtWriteFile	buffer => 3€DÌD$4 0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.627953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.637953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.647953		NtWriteFile	buffer => 4€DÐ430‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.657953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.657953		NtWriteFile	buffer => 5€DÔD$6 :‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.667953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.677953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.677953		NtWriteFile	buffer => 6€DØ45:‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.687953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.687953		NtWriteFile	buffer => 7€ÜD$8 D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.697953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.707953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.707953		NtWriteFile	buffer => 8ˆà47D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.717953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.727953		NtWriteFile	buffer => 9€äD$: v‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.737953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.737953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.747953		NtWriteFile	buffer => :€è49v‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.757953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.757953		NtWriteFile	buffer => ;€ìD$< ¨‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.767953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.777953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.777953		NtWriteFile	buffer => <€ð4;¨‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.787953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.797953		NtWriteFile	buffer => =€ô4=î‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.797953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.807953		NtWriteFile	buffer => >€øD$? >Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.817953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.817953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.827953		NtWriteFile	buffer => ?€ü4>>Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.837953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.847953		NtWriteFile	buffer => @€ D$A pŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.847953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.857953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.867953		NtWriteFile	buffer => A€ 4@pŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.947953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:00.997953		NtWriteFile	buffer => B€ L$C „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.087953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.107953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.137953		NtWriteFile	buffer => C€ LDD „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.148953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.148953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.158953		NtWriteFile	buffer => DÐ <B„Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.168953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.178953		NtWriteFile	buffer => E€ D$F ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.178953		NtWriteFile	buffer => Øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.188953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.198953		NtWriteFile	buffer => FØ 4EŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.208953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.208953		NtWriteFile	buffer => G€ D$H ˜Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.218953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.218953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.228953		NtWriteFile	buffer => H€ 4G˜Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.238953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.248953		NtWriteFile	buffer => I€$ D$J ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.248953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.258953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.268953		NtWriteFile	buffer => J€( 4I‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.268953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.278953		NtWriteFile	buffer => K€, D$L t‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.288953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.298953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.298953		NtWriteFile	buffer => LÀ0 4Kt‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.308953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.318953		NtWriteFile	buffer => M€4 D$N ċ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.328953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.328953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.338953		NtWriteFile	buffer => N€8 4Mċ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.348953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.348953		NtWriteFile	buffer => O€< D$P ΋ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.358953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.358953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.368953		NtWriteFile	buffer => P€@ 4O΋ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.378953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.378953		NtWriteFile	buffer => Q€D D$R ؋ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.388953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.398953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.398953		NtWriteFile	buffer => R€H 4Q؋ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.408953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.418953		NtWriteFile	buffer => S€L D$T â‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.418953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.428953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.438953		NtWriteFile	buffer => T€P 4Sâ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.438953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.448953		NtWriteFile	buffer => U€DT D$V file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.458953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.458953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.468953		NtWriteFile	buffer => V€DX 4U file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.478953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.478953		NtWriteFile	buffer => W€\ D$X (Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.488953		NtWriteFile	buffer => ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.498953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.498953		NtWriteFile	buffer => Xð` 4W(Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.508953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.518953		NtWriteFile	buffer => Y€d D$Z dŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.518953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.528953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.538953		NtWriteFile	buffer => Z€h 4YdŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.538953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.548953		NtWriteFile	buffer => [€l D$\ –Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.558953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.558953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.568953		NtWriteFile	buffer => \€p 4[–Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.578953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.578953		NtWriteFile	buffer => ]€t D$^  Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.588953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.598953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.598953		NtWriteFile	buffer => ^Ðx 4] Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.608953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.618953		NtWriteFile	buffer => _€| 4_´Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.618953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.628953		NtWriteFile	buffer => `€@€ 4` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.638953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.648953		NtWriteFile	buffer => a€4„ L$b  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.648953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.658953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.668953		NtWriteFile	buffer => b€4ˆ 4a file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.668953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.678953		NtWriteFile	buffer => c€Œ D$d 6 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.688953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.688953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.698953		NtWriteFile	buffer => d€ 4c6 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.708953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.708953		NtWriteFile	buffer => e€” 4e˜  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.718953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.728953		NtWriteFile	buffer => f€˜ 4f¢  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.728953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.738953		NtWriteFile	buffer => g€œ 4gÊ  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.738953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.748953		NtWriteFile	buffer => h€  D$i Œ´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.758953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.758953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.768953		NtWriteFile	buffer => iˆ¤ 4hŒ´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.768953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.778953		NtWriteFile	buffer => j€¨ D$k åˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.788953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.788953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.798953		NtWriteFile	buffer => k¬ 4jåˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.798953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.808953		NtWriteFile	buffer => l€° D$m ½ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.818953		NtWriteFile	buffer => ˜ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.818953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.828953		NtWriteFile	buffer => m˜´ 4l½ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.828953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.838953		NtWriteFile	buffer => n D¸ 4n file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.849953		NtWriteFile	buffer => ` `` ` ` ` `þÿÿþÿÿÙÙÚÚþÿÿþÿÿ þÿÿ þÿÿ þÿÿ þÿÿþÿÿþÿÿÔÔÒÝÐÐÑÑ1 1 àýÿÿàýÿÿþýÿÿþýÿÿÿýÿþÿÿþÿÿ ÿýÿÿÿýÿÿÏÏ\\Ö ëýÿÿëýÿÿöýÿÿöýÿÿöýÿÿ÷ýÿÿ÷ýÿÿçýÿÿçýÿÿêýÿÿêýÿÿéýÿÿéýÿÿÜÜÜýÿÿÜýÿÿÝýÿÿÝýÿÿÞýÿÿÞýÿÿ0 0 ßýÿÿßýÿÿûýÿÿûýÿÿ''Øôýÿÿèýÿÿèýÿÿâýÿÿâýÿÿààááäýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.849953		NtWriteFile	buffer => ¼ü$T¤”9”9;;;;È%È%¨9¨9à%à%ø%ø%8;8;&T;T;h;€;˜;˜;¨;¨;¸;¸;Ô;Ô;t&t&ˆ&ttØ9Ø9À9À9ì9ì9::::0:0:”:”:¤&¤&ð;ð;<<(<ô:ô:@<@<H'H'H'`'`'X<X<p<p<à'à'ˆ<ˆ<¤<¤<¼<¼<Ð<Ð<ä<ä<L)L)==h:h: =8=xx€:€:8$H$œ)L=L=`=`=€=€=˜= file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.859953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <X€œÄà$LhŒ¤Àè 8`| ¸Üô8`|¤Ìè,Tp˜´Üø <d€¨Äì0Lt¬Ôð 4 \ „   È ä  ( P l ” ° Ø ô 8`|¤Àäü$@h„¬Èð ( @ h „ ¬ È ä D`ˆ¤Ìè file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.909953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.919953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.929953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.939953		NtWriteFile	buffer => °Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.939953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.949953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.969953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.969953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.979953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.989953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.989953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:01.999953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.009953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.009953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.019953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.019953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.029953		NtWriteFile	buffer => ÀØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.039953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.039953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.049953		NtWriteFile	buffer => € ÐØ €€ €, à@ ¸Xðphˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.049953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.059953		NtWriteFile	buffer => €D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.069953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.069953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.079953		NtWriteFile	buffer => ˆ 4‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.079953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.089953		NtWriteFile	buffer => €$D$  ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.099953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.099953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.109953		NtWriteFile	buffer => ˆ(4  ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.119953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.129953		NtWriteFile	buffer => €,D$ ´‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.129953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.139953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.149953		NtWriteFile	buffer => 04´‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.159953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.169953		NtWriteFile	buffer => €D4D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.179953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.179953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.189953		NtWriteFile	buffer => €D84 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.199953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.199953		NtWriteFile	buffer => €<L$ ¾‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.209953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.219953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.219953		NtWriteFile	buffer => €@4¾‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.229953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.239953		NtWriteFile	buffer => €DD$ ,ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.249953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.249953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.259953		NtWriteFile	buffer => €H4,ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.269953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.279953		NtWriteFile	buffer => €LD$ 6ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.279953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.289953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.299953		NtWriteFile	buffer => €P46ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.299953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.309953		NtWriteFile	buffer => €TD$ @ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.319953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.319953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.329953		NtWriteFile	buffer => €X4@ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.339953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.349953		NtWriteFile	buffer => €\D$ àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.349953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.359953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.369953		NtWriteFile	buffer => €`4àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.379953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.379953		NtWriteFile	buffer => €DdL$ ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.389953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.389953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.399953		NtWriteFile	buffer => €hLD ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.409953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.409953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.419953		NtWriteFile	buffer => ¸l<ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.429953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.439953		NtWriteFile	buffer => €DpD$ þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.439953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.449953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.459953		NtWriteFile	buffer => €Dt4þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.469953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.469953		NtWriteFile	buffer => €DxD$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.479953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.489953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.489953		NtWriteFile	buffer => €D|4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.499953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.509953		NtWriteFile	buffer => €D€D$! ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.509953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.519953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.519953		NtWriteFile	buffer => !€D„4 ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.529953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.540953		NtWriteFile	buffer => "€DˆD$# ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.550953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.550953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.560953		NtWriteFile	buffer => #€DŒ4"‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.560953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.570953		NtWriteFile	buffer => $€DD$% &‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.580953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.590953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.590953		NtWriteFile	buffer => %€D”4$&‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.600953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.610953		NtWriteFile	buffer => &€D˜D$' 0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.610953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.620953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.630953		NtWriteFile	buffer => '€Dœ4&0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.630953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.640953		NtWriteFile	buffer => (€D D$) :‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.650953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.650953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.660953		NtWriteFile	buffer => )€D¤4(:‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.670953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.670953		NtWriteFile	buffer => *€¨D$+ D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.680953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.690953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.690953		NtWriteFile	buffer => +ˆ¬4*D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.700953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.710953		NtWriteFile	buffer => ,€°D$- ¨‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.710953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.720953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.730953		NtWriteFile	buffer => -€´4,¨‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.730953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.740953		NtWriteFile	buffer => .€¸4.Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.750953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.750953		NtWriteFile	buffer => /€D¼D$0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.760953		NtWriteFile	buffer => øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.770953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.770953		NtWriteFile	buffer => 0øDÀ4/ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.780953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.790953		NtWriteFile	buffer => 1€ÄL$2 Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.790953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.800953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.810953		NtWriteFile	buffer => 2€È41Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.810953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.820953		NtWriteFile	buffer => 3€ÌD$4 *Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.830953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.830953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.840953		NtWriteFile	buffer => 4Ð43*Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.850953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.860953		NtWriteFile	buffer => 5€DÔL$6 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.860953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.870953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.880953		NtWriteFile	buffer => 6€DØ45 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.890953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.890953		NtWriteFile	buffer => 7€ÜD$8 >Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.900953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.900953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.910953		NtWriteFile	buffer => 8€à47>Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.920953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.920953		NtWriteFile	buffer => 9€äD$: HŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.930953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.930953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.940953		NtWriteFile	buffer => :è49HŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.950953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.950953		NtWriteFile	buffer => ;€ìL$< „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.960953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.960953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.970953		NtWriteFile	buffer => <€ðLD= „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.980953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.990953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:02.990953		NtWriteFile	buffer => =Ðô<;„Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.000953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.000953		NtWriteFile	buffer => >€øD$? ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.010953		NtWriteFile	buffer => Øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.020953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.020953		NtWriteFile	buffer => ?Øü4>ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.030953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.040953		NtWriteFile	buffer => @€ D$A ¬Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.040953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.040953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.050953		NtWriteFile	buffer => A 4@¬Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.060953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.070953		NtWriteFile	buffer => B€ D$C (Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.070953		NtWriteFile	buffer => ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.080953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.080953		NtWriteFile	buffer => Cð 4B(Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.090953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.090953		NtWriteFile	buffer => D€ D$E –Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.100953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.110953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.110953		NtWriteFile	buffer => E€ 4D–Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.120953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.130953		NtWriteFile	buffer => F€ L$G ªŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.130953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.140953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.140953		NtWriteFile	buffer => G€ 4FªŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.150953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.160953		NtWriteFile	buffer => H€ L$I Ȍ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.160953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.170953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.180953		NtWriteFile	buffer => I€$ 4HȌ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.180953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.190953		NtWriteFile	buffer => J€@( 4J file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.190953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.200953		NtWriteFile	buffer => K€4, L$L  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.210953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.210953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.220953		NtWriteFile	buffer => L€40 4K file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.220953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.230953		NtWriteFile	buffer => M€4 dN"ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.241953		NtWriteFile	buffer => ¸(?¸@? file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.241953		NtWriteFile	buffer => @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.251953		NtWriteFile	buffer => N€8 |$M"ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.251953		NtWriteFile	buffer => ¸(?¸@?¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.261953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.271953		NtWriteFile	buffer => O€< dPø‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.271953		NtWriteFile	buffer => ¸@?¸(? file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.281953		NtWriteFile	buffer => @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.281953		NtWriteFile	buffer => P€@ |$Oø‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.291953		NtWriteFile	buffer => ¸@?¸(?¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.291953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.301953		NtWriteFile	buffer => Q€D LR ¦‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.311953		NtWriteFile	buffer => ¸@? file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.311953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.321953		NtWriteFile	buffer => R€H \$Q¦‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.331953		NtWriteFile	buffer => ¸@? €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.331953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.341953		NtWriteFile	buffer => S€L dS„  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.351953		NtWriteFile	buffer => ¸|?¸@? file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.351953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.361953		NtWriteFile	buffer => T€P 4TŽ  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.371953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.371953		NtWriteFile	buffer => U€T LU ò  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.381953		NtWriteFile	buffer => ¸@? file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.391953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.391953		NtWriteFile	buffer => V€X D$W Œ´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.401953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.411953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.411953		NtWriteFile	buffer => Wˆ\ 4VŒ´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.421953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.431953		NtWriteFile	buffer => X D` 4X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.441953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.441953		NtWriteFile	buffer => Y€d D$Z  Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.451953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.461953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.461953		NtWriteFile	buffer => ZÐh 4Y Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.471953		NtWriteFile	buffer => ` `` ` ` ` `þÿÿþÿÿ þÿÿ þÿÿþÿÿþÿÿõ õ YYZZ[[þýÿÿþýÿÿÿýÿþÿÿþÿÿ ÿýÿÿÿýÿÿ\\íýÿÿ“ “ òýÿÿòýÿÿ3 3 ^^ ø ø öýÿÿöýÿÿöýÿÿ÷ýÿÿ÷ýÿÿìýÿÿìýÿÿûýÿÿûýÿÿö ö ccôýÿÿïýÿÿïýÿÿðýÿÿðýÿÿñýÿÿñýÿÿ×ýÿÿÖýÿÿÕýÿÿâýÿÿâýÿÿäýÿÿ'' file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.481953		NtWriteFile	buffer => ¼ü$T¤È%È%à%à%ø%ø%8;8;à=à=ø=ø=>>(>(>t&t&ˆ&ttØ9Ø9À9À9ì9ì9::::0:0:”:”:¤&¤&<<@>X>X>p>p>ˆ>ˆ> > >ô:ô:¸>¸>H'H'H'`'`'Ð>Ð>L)L)è>è>??8=xx??X?X?8)8)h?œ”?L=L=˜=h:h: file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.481953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <X|”¼ØD`ˆ¤Ìè8T|˜ÀÜ HdŒ¨Ðì0Xtœ¸Ôø8T|˜¼Ôü@\„¬Èð 4 P x ” ¼ Ø  D ` x   ¼ ð 0d¤Ì4Px ¼Ôü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.491953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.501953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.501953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.511953		NtWriteFile	buffer => Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.521953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.521953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.531953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.541953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.541953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.551953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.561953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.561953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.571953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.581953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.581953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.591953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.601953		NtWriteFile	buffer => 0Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.601953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.611953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.621953		NtWriteFile	buffer => € @Ø €€ €, P@ ¸X`phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.621953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.631953		NtWriteFile	buffer => €D$ d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.641953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.641953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.651953		NtWriteFile	buffer => € 4d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.661953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.671953		NtWriteFile	buffer => €$D$ n‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.671953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.681953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.681953		NtWriteFile	buffer => €(4 n‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.691953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.701953		NtWriteFile	buffer => €,D$ x‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.701953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.711953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.721953		NtWriteFile	buffer => €04x‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.721953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.731953		NtWriteFile	buffer => €4D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.741953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.741953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.751953		NtWriteFile	buffer => ˆ84 ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.761953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.761953		NtWriteFile	buffer => €<D$ Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.771953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.781953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.781953		NtWriteFile	buffer => À@4Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.791953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.801953		NtWriteFile	buffer => €DD$  ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.801953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.811953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.821953		NtWriteFile	buffer => ˆH4 ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.821953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.831953		NtWriteFile	buffer => €LD$ ´‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.841953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.851953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.851953		NtWriteFile	buffer => P4´‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.861953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.871953		NtWriteFile	buffer => €DTD$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.881953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.881953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.891953		NtWriteFile	buffer => €DX4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.901953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.901953		NtWriteFile	buffer => €\L$ ¾‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.911953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.921953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.932953		NtWriteFile	buffer => €`4¾‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.932953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.942953		NtWriteFile	buffer => €d4҇ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.952953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.952953		NtWriteFile	buffer => €hD$ ,ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.962953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.972953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.972953		NtWriteFile	buffer => €l4,ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.982953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.992953		NtWriteFile	buffer => €pD$ 6ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:03.992953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.002953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.012953		NtWriteFile	buffer => €t46ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.012953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.022953		NtWriteFile	buffer => €xD$ @ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.032953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.032953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.042953		NtWriteFile	buffer => €|4@ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.052953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.052953		NtWriteFile	buffer => €€4 |ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.062953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.072953		NtWriteFile	buffer => !€@„4! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.072953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.082953		NtWriteFile	buffer => "€ˆD$# ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.092953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.092953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.102953		NtWriteFile	buffer => #€Œ4"ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.112953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.112953		NtWriteFile	buffer => $€D$% ֈ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.122953		NtWriteFile	buffer => xÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.132953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.142953		NtWriteFile	buffer => %x”4$ֈ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.142953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.152953		NtWriteFile	buffer => &€˜D$' àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.162953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.162953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.172953		NtWriteFile	buffer => '€œ4&àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.182953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.182953		NtWriteFile	buffer => (€D L$( ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.192953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.202953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.202953		NtWriteFile	buffer => )€¤LD* ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.212953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.222953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.232953		NtWriteFile	buffer => *¸¨<)ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.232953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.242953		NtWriteFile	buffer => +€D¬D$, þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.252953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.252953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.262953		NtWriteFile	buffer => ,€D°4+þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.272953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.272953		NtWriteFile	buffer => -€D´D$. ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.282953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.292953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.292953		NtWriteFile	buffer => .€D¸4-‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.302953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.312953		NtWriteFile	buffer => /€D¼D$0 ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.312953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.322953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.332953		NtWriteFile	buffer => 0€DÀ4/‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.342953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.342953		NtWriteFile	buffer => 1€DÄD$2 ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.352953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.362953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.372953		NtWriteFile	buffer => 2€DÈ41‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.382953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.382953		NtWriteFile	buffer => 3€DÌD$4 &‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.392953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.402953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.402953		NtWriteFile	buffer => 4€DÐ43&‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.412953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.422953		NtWriteFile	buffer => 5€DÔD$6 0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.432953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.432953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.442953		NtWriteFile	buffer => 6€DØ450‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.452953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.462953		NtWriteFile	buffer => 7€DÜD$8 :‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.462953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.472953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.482953		NtWriteFile	buffer => 8€Dà47:‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.482953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.492953		NtWriteFile	buffer => 9€äD$: D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.502953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.502953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.512953		NtWriteFile	buffer => :ˆè49D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.522953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.532953		NtWriteFile	buffer => ;€ìD$< v‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.532953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.542953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.552953		NtWriteFile	buffer => <€ð4;v‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.552953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.562953		NtWriteFile	buffer => =€ô4=î‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.572953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.572953		NtWriteFile	buffer => >€ø4>Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.582953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.592953		NtWriteFile	buffer => ?€DüD$@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.592953		NtWriteFile	buffer => øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.602953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.612953		NtWriteFile	buffer => @øD 4? file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.612953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.622953		NtWriteFile	buffer => A€ L$B Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.633953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.643953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.643953		NtWriteFile	buffer => B€ 4AŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.653953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.663953		NtWriteFile	buffer => C€ D$D Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.663953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.673953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.683953		NtWriteFile	buffer => D€ 4C Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.683953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.693953		NtWriteFile	buffer => E€ D$F *Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.703953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.703953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.713953		NtWriteFile	buffer => F 4E*Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.723953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.723953		NtWriteFile	buffer => G€ L$H 4Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.733953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.743953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.743953		NtWriteFile	buffer => H€ 4G4Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.753953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.763953		NtWriteFile	buffer => I€$ D$J >Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.763953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.773953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.773953		NtWriteFile	buffer => J€( 4I>Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.783953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.793953		NtWriteFile	buffer => K€, D$L HŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.793953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.803953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.813953		NtWriteFile	buffer => L0 4KHŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.813953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.823953		NtWriteFile	buffer => M€4 4MRŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.833953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.833953		NtWriteFile	buffer => N€8 D$O \Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.843953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.853953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.853953		NtWriteFile	buffer => O€< 4N\Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.863953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.873953		NtWriteFile	buffer => P€@ D$Q pŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.883953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.883953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.893953		NtWriteFile	buffer => Q€D 4PpŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.903953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.903953		NtWriteFile	buffer => R€H L$S „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.913953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.923953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.923953		NtWriteFile	buffer => S€L LDT „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.933953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.943953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.953953		NtWriteFile	buffer => TÐP <R„Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.953953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.963953		NtWriteFile	buffer => U€T D$V ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.973953		NtWriteFile	buffer => Øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.973953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:04.983953		NtWriteFile	buffer => VØX 4UŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.003953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.003953		NtWriteFile	buffer => W€\ D$X ċ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.013953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.023953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.023953		NtWriteFile	buffer => X€` 4Wċ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.033953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.043953		NtWriteFile	buffer => Y€d D$Z ΋ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.043953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.053953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.063953		NtWriteFile	buffer => Z€h 4Y΋ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.073953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.073953		NtWriteFile	buffer => [€l D$\ ؋ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.083953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.093953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.093953		NtWriteFile	buffer => \€p 4[؋ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.103953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.113953		NtWriteFile	buffer => ]€t D$^ â‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.113953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.123953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.133953		NtWriteFile	buffer => ^€x 4]â‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.143953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.153953		NtWriteFile	buffer => _€| D$` ì‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.163953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.163953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.173953		NtWriteFile	buffer => `€€ 4_ì‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.183953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.193953		NtWriteFile	buffer => a€„ D$b (Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.193953		NtWriteFile	buffer => ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.203953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.213953		NtWriteFile	buffer => bðˆ 4a(Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.223953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.223953		NtWriteFile	buffer => c€Œ D$d <Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.233953		NtWriteFile	buffer => hÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.243953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.253953		NtWriteFile	buffer => dh 4c<Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.263953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.263953		NtWriteFile	buffer => e€” D$f –Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.273953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.283953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.283953		NtWriteFile	buffer => f€˜ 4e–Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.293953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.303953		NtWriteFile	buffer => g€œ D$h  Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.313953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.324953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.324953		NtWriteFile	buffer => hР 4g Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.334953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.344953		NtWriteFile	buffer => i€¤ L$j ªŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.354953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.364953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.364953		NtWriteFile	buffer => j€¨ 4iªŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.374953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.384953		NtWriteFile	buffer => k€¬ 4k´Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.394953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.394953		NtWriteFile	buffer => l€° L$m Ȍ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.404953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.414953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.424953		NtWriteFile	buffer => m€´ 4lȌ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.424953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.434953		NtWriteFile	buffer => n€@¸ 4n file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.444953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.454953		NtWriteFile	buffer => o€4¼ L$p  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.454953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.464953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.474953		NtWriteFile	buffer => p€4À 4o file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.484953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.484953		NtWriteFile	buffer => q€Ä dr"ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.494953		NtWriteFile	buffer => ¸(?¸@? file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.504953		NtWriteFile	buffer => @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.514953		NtWriteFile	buffer => r€È |$q"ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.514953		NtWriteFile	buffer => ¸(?¸@?¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.524953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.534953		NtWriteFile	buffer => s€Ì dtø‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.544953		NtWriteFile	buffer => ¸@?¸(? file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.544953		NtWriteFile	buffer => @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.554953		NtWriteFile	buffer => t€Ð |$sø‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.564953		NtWriteFile	buffer => ¸@?¸(?¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.574953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.574953		NtWriteFile	buffer => u€Ô du„  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.584953		NtWriteFile	buffer => ¸|?¸@? file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.594953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.604953		NtWriteFile	buffer => v€Ø 4vŽ  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.604953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.614953		NtWriteFile	buffer => wۆ 4w  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.624953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.634953		NtWriteFile	buffer => x€à Lx ò  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.634953		NtWriteFile	buffer => ¸@? file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.644953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.654953		NtWriteFile	buffer => y€ä 4y˜  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.664953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.664953		NtWriteFile	buffer => z€è 4z¢  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.674953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.684953		NtWriteFile	buffer => {€ì 4{Ê  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.694953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.764953		NtWriteFile	buffer => |€ð D$} Œ´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.834953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:05.934953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.014953		NtWriteFile	buffer => }ˆô 4|Œ´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.025953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.035953		NtWriteFile	buffer => ~€ø D$ åˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.055953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.055953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.075953		NtWriteFile	buffer => ü 4~åˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.075953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.085953		NtWriteFile	buffer => €€D$ ½ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.095953		NtWriteFile	buffer => ˜ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.105953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.105953		NtWriteFile	buffer => ˜4€½ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.115953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.125953		NtWriteFile	buffer => ‚ D4‚ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.135953		NtWriteFile	buffer => ` `` ` ` ` `þÿÿþÿÿÙÙÚÚþÿÿþÿÿ þÿÿ þÿÿ þÿÿ þÿÿþÿÿþÿÿõ õ YYZZ[[ÒÝÐÐ1 1 þýÿÿþýÿÿÿýÿþÿÿþÿÿ ÿýÿÿÿýÿÿÏÏÖíýÿÿ“ “ òýÿÿòýÿÿ]]3 3 ^^ ø ø ù ÷ ÷ ëýÿÿëýÿÿöýÿÿöýÿÿöýÿÿ÷ýÿÿ÷ýÿÿÜÜÜýÿÿÜýÿÿÝýÿÿÝýÿÿÞýÿÿÞýÿÿ0 0 4 4 ûýÿÿûýÿÿ''ö ö Øccôýÿÿïýÿÿïýÿÿðýÿÿðýÿÿ×ýÿÿÖýÿÿéÕýÿÿâýÿÿâýÿÿààááäýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.135953		NtWriteFile	buffer => ¼ü$T¤”9”9;;;;È%È%¨9¨9à%à%ø%ø%8;8;à=à=&ø=ø=>>(>(>h;€;˜;˜;¸;¸;t&t&ˆ&ttØ9Ø9À9À9ì9ì9::::0:0:”:”:¤&¤&ð;ð;(<@>X>X>p>p>¬?¬?ˆ>ˆ> > >ô:ô:¸>¸>À?Ø?Ø?@<@<H'H'H'`'`'ˆ<ˆ<¤<¤<¼<¼<Ð<Ð<ä<ä<L)L)ô?ô?h:h:è>è> =??8=xx??X?X?h?œ@”?8$H$œ)L=L=`=`=€=€=˜= file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.145953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <X€œÄà$LhŒ¤Ìè,HpŒ´Ðì,HpŒ´Ðø <d€¨Äì0Lt¸Ôü@\„ ¼Øü < X € œ Ä à  $ L h  ¬ È ð 4Px ¼ä(Dlˆ°Ìô 8 T | ˜ À Ü  HdŒ¨Äì Hd˜ØL€œ¸àü4\x ¼ä file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.155953		NtWriteFile	buffer => Ø file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.165953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.175953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.175953		NtWriteFile	buffer => xØ `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.185953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.195953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.205953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.205953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.215953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.225953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.235953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.245953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.245953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.255953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.265953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.275953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.285953		NtWriteFile	buffer => ˆØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.295953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.295953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.305953		NtWriteFile	buffer => € ˜Ø €€ €, ¨@ ¸X¸phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.315953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.325953		NtWriteFile	buffer => €D$ 2‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.335953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.335953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.345953		NtWriteFile	buffer => € 42‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.355953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.365953		NtWriteFile	buffer => €$D$ F‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.375953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.385953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.385953		NtWriteFile	buffer => À(4 F‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.395953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.405953		NtWriteFile	buffer => €,D$ d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.415953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.425953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.425953		NtWriteFile	buffer => €04d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.435953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.445953		NtWriteFile	buffer => €4D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.455953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.465953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.465953		NtWriteFile	buffer => ˆ84 ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.475953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.485953		NtWriteFile	buffer => €<D$ Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.495953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.505953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.505953		NtWriteFile	buffer => À@4Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.515953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.525953		NtWriteFile	buffer => €DDD$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.535953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.535953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.545953		NtWriteFile	buffer => €DH4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.555953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.565953		NtWriteFile	buffer => €LD$ ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.575953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.575953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.585953		NtWriteFile	buffer => €P4ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.595953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.605953		NtWriteFile	buffer => €TD$ àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.615953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.615953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.625953		NtWriteFile	buffer => €X4àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.635953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.645953		NtWriteFile	buffer => €D\L$ ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.655953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.655953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.665953		NtWriteFile	buffer => €`LD ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.675953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.685953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.695953		NtWriteFile	buffer => ¸d<ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.695953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.705953		NtWriteFile	buffer => €DhD$ þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.716953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.716953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.726953		NtWriteFile	buffer => €Dl4þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.736953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.746953		NtWriteFile	buffer => €DpD$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.746953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.756953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.766953		NtWriteFile	buffer => €Dt4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.776953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.776953		NtWriteFile	buffer => €DxD$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.786953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.796953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.806953		NtWriteFile	buffer => €D|4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.806953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.816953		NtWriteFile	buffer => €D€D$! ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.826953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.826953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.836953		NtWriteFile	buffer => !€D„4 ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.846953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.856953		NtWriteFile	buffer => "€DˆD$# &‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.866953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.866953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.876953		NtWriteFile	buffer => #€DŒ4"&‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.886953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.896953		NtWriteFile	buffer => $€DD$% 0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.896953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.906953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.916953		NtWriteFile	buffer => %€D”4$0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.926953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.936953		NtWriteFile	buffer => &€D˜D$' :‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.936953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.946953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.956953		NtWriteFile	buffer => '€Dœ4&:‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.966953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.976953		NtWriteFile	buffer => (€ D$) D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.976953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.986953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:06.996953		NtWriteFile	buffer => )ˆ¤4(D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.006953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.046953		NtWriteFile	buffer => *€¨D$+ >Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.136953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.216953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.336953		NtWriteFile	buffer => +€¬4*>Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.346953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.356953		NtWriteFile	buffer => ,€°L$- „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.366953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.376953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.386953		NtWriteFile	buffer => -€´LD. „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.396953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.407953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.417953		NtWriteFile	buffer => .и<,„Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.427953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.437953		NtWriteFile	buffer => /€¼D$0 ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.437953		NtWriteFile	buffer => Øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.447953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.457953		NtWriteFile	buffer => 0ØÀ4/ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.467953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.477953		NtWriteFile	buffer => 1€DÄD$2 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.477953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.487953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.497953		NtWriteFile	buffer => 2DÈ41 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.507953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.507953		NtWriteFile	buffer => 3€ÌL$4 .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.517953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.527953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.537953		NtWriteFile	buffer => 4€ÐLD5 .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.537953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.547953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.557953		NtWriteFile	buffer => 5ÐÔ<3.‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.567953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.577953		NtWriteFile	buffer => 6€ØD$7 8‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.577953		NtWriteFile	buffer => Èÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.587953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.597953		NtWriteFile	buffer => 7ÈÜ468‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.607953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.617953		NtWriteFile	buffer => 8ۈD$9 (Πfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.617953		NtWriteFile	buffer => Èÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.627953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.637953		NtWriteFile	buffer => 9Èä48(Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.647953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.657953		NtWriteFile	buffer => :€èD$; æŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.657953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.667953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.677953		NtWriteFile	buffer => ;€ì4:æŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.687953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.687953		NtWriteFile	buffer => <€@ð4< file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.697953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.707953		NtWriteFile	buffer => =€4ôL$>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.717953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.717953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.727953		NtWriteFile	buffer => >€4ø4= file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.737953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.737953		NtWriteFile	buffer => ?€üD$@ 6 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.747953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.757953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.757953		NtWriteFile	buffer => @€ 4?6 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.767953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.777953		NtWriteFile	buffer => A D 4A file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.787953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.787953		NtWriteFile	buffer => B€ D$C ]‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.797953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.807953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.807953		NtWriteFile	buffer => C€ 4B]‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.817953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.827953		NtWriteFile	buffer => D€ D$E  Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.837953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.847953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.847953		NtWriteFile	buffer => EÐ 4D Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.857953		NtWriteFile	buffer => ` `` ` ` ` `áýÿÿáýÿÿÆÆþÿÿþÿÿþÿÿþÿÿ þÿÿ þÿÿúýÿÿúýÿÿþýÿÿþýÿÿÿýÿþÿÿþÿÿ ÿýÿÿÿýÿÿ öýÿÿöýÿÿöýÿÿ÷ýÿÿ÷ýÿÿìýÿÿìýÿÿõýÿÿõýÿÿõýÿÿ¼¼ôýÿÿèýÿÿèýÿÿäýÿÿãýÿÿãýÿÿ'' file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.867953		NtWriteFile	buffer => ¼ü$T¤99@@”9”9È%È%¨9¨98;8;L&L&t&t&ˆ&ttØ9Ø9À9À9ì9ì9::::0:0:”:”:¤&¤&ô:ô:H'H'H'`'`'Ð>Ð>”'”'”'L:L:L)L)4@4@8=xx€:€:˜=L@L@h:h: file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.867953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <X€œÄàD`ˆ¤Ìô8T|˜ÀÜ HdŒ¨Ðì0XtœÄà$H`ˆ°Ìô8T|˜°Øô 8 P x ” ¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.877953		NtWriteFile	buffer => Ø file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.887953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.897953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.907953		NtWriteFile	buffer => ØØ `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.907953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.917953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.927953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.927953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.937953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.947953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.957953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.957953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.967953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.977953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.987953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.987953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:07.997953		NtWriteFile	buffer => èØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.007953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.007953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.017953		NtWriteFile	buffer => € øØ €€ €, @ ¸Xphˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.027953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.027953		NtWriteFile	buffer => €D$ 2‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.037953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.047953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.047953		NtWriteFile	buffer => € 42‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.057953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.067953		NtWriteFile	buffer => €$D$ F‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.077953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.077953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.087953		NtWriteFile	buffer => À(4 F‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.097953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.108953		NtWriteFile	buffer => €,D$ d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.108953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.118953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.128953		NtWriteFile	buffer => €04d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.138953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.148953		NtWriteFile	buffer => €4D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.148953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.158953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.168953		NtWriteFile	buffer => ˆ84 ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.178953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.178953		NtWriteFile	buffer => €<D$ Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.188953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.198953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.208953		NtWriteFile	buffer => À@4Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.208953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.218953		NtWriteFile	buffer => €DDD$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.228953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.238953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.238953		NtWriteFile	buffer => €DH4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.248953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.258953		NtWriteFile	buffer => €LD$ ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.268953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.278953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.278953		NtWriteFile	buffer => €P4ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.288953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.298953		NtWriteFile	buffer => €TD$ àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.308953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.318953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.318953		NtWriteFile	buffer => €X4àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.328953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.338953		NtWriteFile	buffer => €D\L$ ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.348953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.538953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.638953		NtWriteFile	buffer => €`LD ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.658953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.668953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.688953		NtWriteFile	buffer => ¸d<ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.698953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.708953		NtWriteFile	buffer => €DhD$ þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.738953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.748953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.758953		NtWriteFile	buffer => €Dl4þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.768953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.778953		NtWriteFile	buffer => €DpD$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.778953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.788953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.799953		NtWriteFile	buffer => €Dt4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.809953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.819953		NtWriteFile	buffer => €DxD$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.819953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.829953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.839953		NtWriteFile	buffer => €D|4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.849953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.859953		NtWriteFile	buffer => €D€D$! ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.869953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.869953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.879953		NtWriteFile	buffer => !€D„4 ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.889953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.899953		NtWriteFile	buffer => "€DˆD$# &‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.909953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.909953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.919953		NtWriteFile	buffer => #€DŒ4"&‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.929953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.939953		NtWriteFile	buffer => $€DD$% 0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.949953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.949953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.959953		NtWriteFile	buffer => %€D”4$0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.969953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.979953		NtWriteFile	buffer => &€D˜D$' :‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.989953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.989953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:08.999953		NtWriteFile	buffer => '€Dœ4&:‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.009953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.019953		NtWriteFile	buffer => (€ D$) D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.029953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.029953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.039953		NtWriteFile	buffer => )ˆ¤4(D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.049953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.059953		NtWriteFile	buffer => *€¨D$+ >Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.069953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.069953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.079953		NtWriteFile	buffer => +€¬4*>Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.089953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.099953		NtWriteFile	buffer => ,€°L$- „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.099953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.109953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.119953		NtWriteFile	buffer => -€´LD. „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.129953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.139953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.149953		NtWriteFile	buffer => .и<,„Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.149953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.159953		NtWriteFile	buffer => /€¼D$0 ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.169953		NtWriteFile	buffer => Øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.179953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.189953		NtWriteFile	buffer => 0ØÀ4/ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.189953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.199953		NtWriteFile	buffer => 1€DÄD$2 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.209953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.219953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.219953		NtWriteFile	buffer => 2DÈ41 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.229953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.239953		NtWriteFile	buffer => 3€ÌL$4 .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.249953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.259953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.269953		NtWriteFile	buffer => 4€ÐLD5 .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.269953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.279953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.289953		NtWriteFile	buffer => 5ÐÔ<3.‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.299953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.299953		NtWriteFile	buffer => 6€ØD$7 8‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.309953		NtWriteFile	buffer => Èÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.319953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.329953		NtWriteFile	buffer => 7ÈÜ468‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.339953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.339953		NtWriteFile	buffer => 8ۈD$9 (Πfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.349953		NtWriteFile	buffer => Èÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.359953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.369953		NtWriteFile	buffer => 9Èä48(Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.379953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.389953		NtWriteFile	buffer => :€èD$; æŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.399953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.399953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.409953		NtWriteFile	buffer => ;€ì4:æŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.419953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.429953		NtWriteFile	buffer => <€@ð4< file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.439953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.449953		NtWriteFile	buffer => =€4ôL$>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.449953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.459953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.469953		NtWriteFile	buffer => >€4ø4= file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.479953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.489953		NtWriteFile	buffer => ?€üD$@ 6 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.500953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.500953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.510953		NtWriteFile	buffer => @€ 4?6 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.520953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.530953		NtWriteFile	buffer => A D 4A file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.540953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.540953		NtWriteFile	buffer => B€ D$C ]‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.550953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.560953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.570953		NtWriteFile	buffer => C€ 4B]‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.580953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.580953		NtWriteFile	buffer => D€ D$E  Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.590953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.600953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.610953		NtWriteFile	buffer => EÐ 4D Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.620953		NtWriteFile	buffer => ` `` ` ` ` `áýÿÿáýÿÿÆÆþÿÿþÿÿþÿÿþÿÿ þÿÿ þÿÿúýÿÿúýÿÿþýÿÿþýÿÿÿýÿþÿÿþÿÿ ÿýÿÿÿýÿÿ öýÿÿöýÿÿöýÿÿ÷ýÿÿ÷ýÿÿìýÿÿìýÿÿõýÿÿõýÿÿõýÿÿ¼¼ôýÿÿèýÿÿèýÿÿäýÿÿãýÿÿãýÿÿ'' file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.620953		NtWriteFile	buffer => ¼ü$T¤99@@”9”9È%È%¨9¨98;8;L&L&t&t&ˆ&ttØ9Ø9À9À9ì9ì9::::0:0:”:”:¤&¤&ô:ô:H'H'H'`'`'Ð>Ð>”'”'”'L:L:L)L)4@4@8=xx€:€:˜=L@L@h:h: file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.630953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <X€œÄàD`ˆ¤Ìô8T|˜ÀÜ HdŒ¨Ðì0XtœÄà$H`ˆ°Ìô8T|˜°Øô 8 P x ” ¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.640953		NtWriteFile	buffer => Ø file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.650953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.650953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.660953		NtWriteFile	buffer => (Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.670953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.680953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.680953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.690953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.700953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.710953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.710953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.720953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.740953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:09.930953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.010953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.020953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.040953		NtWriteFile	buffer => 8Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.050953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.060953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.070953		NtWriteFile	buffer => € HØ €€ €, X@ ¸Xhphˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.080953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.080953		NtWriteFile	buffer => €D$ 2‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.090953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.100953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.100953		NtWriteFile	buffer => € 42‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.110953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.120953		NtWriteFile	buffer => €$D$ F‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.120953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.130953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.140953		NtWriteFile	buffer => À(4 F‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.140953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.150953		NtWriteFile	buffer => €,D$ d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.160953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.170953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.170953		NtWriteFile	buffer => €04d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.180953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.191953		NtWriteFile	buffer => €4D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.201953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.201953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.211953		NtWriteFile	buffer => ˆ84 ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.221953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.231953		NtWriteFile	buffer => €<D$ Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.231953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.241953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.251953		NtWriteFile	buffer => À@4Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.251953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.261953		NtWriteFile	buffer => €DDD$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.271953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.281953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.281953		NtWriteFile	buffer => €DH4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.291953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.301953		NtWriteFile	buffer => €LD$ ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.311953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.311953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.321953		NtWriteFile	buffer => €P4ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.331953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.341953		NtWriteFile	buffer => €TD$ àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.351953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.351953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.361953		NtWriteFile	buffer => €X4àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.371953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.371953		NtWriteFile	buffer => €D\L$ ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.381953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.391953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.401953		NtWriteFile	buffer => €`LD ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.401953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.411953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.421953		NtWriteFile	buffer => ¸d<ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.421953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.431953		NtWriteFile	buffer => €DhD$ þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.441953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.441953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.451953		NtWriteFile	buffer => €Dl4þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.461953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.471953		NtWriteFile	buffer => €DpD$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.471953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.481953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.491953		NtWriteFile	buffer => €Dt4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.501953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.501953		NtWriteFile	buffer => €DxD$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.511953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.521953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.531953		NtWriteFile	buffer => €D|4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.541953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.541953		NtWriteFile	buffer => €D€D$! ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.551953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.561953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.561953		NtWriteFile	buffer => !€D„4 ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.571953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.581953		NtWriteFile	buffer => "€DˆD$# &‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.591953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.601953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.601953		NtWriteFile	buffer => #€DŒ4"&‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.611953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.621953		NtWriteFile	buffer => $€DD$% 0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.631953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.641953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.641953		NtWriteFile	buffer => %€D”4$0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.651953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.661953		NtWriteFile	buffer => &€D˜D$' :‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.671953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.681953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.681953		NtWriteFile	buffer => '€Dœ4&:‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.701953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.711953		NtWriteFile	buffer => (€ D$) D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.711953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.721953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.731953		NtWriteFile	buffer => )ˆ¤4(D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.741953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.741953		NtWriteFile	buffer => *€¨D$+ >Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.751953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.761953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.771953		NtWriteFile	buffer => +€¬4*>Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.781953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.781953		NtWriteFile	buffer => ,€°L$- „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.791953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.801953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.811953		NtWriteFile	buffer => -€´LD. „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.821953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.831953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.831953		NtWriteFile	buffer => .и<,„Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.841953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.851953		NtWriteFile	buffer => /€¼D$0 ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.861953		NtWriteFile	buffer => Øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.871953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.881953		NtWriteFile	buffer => 0ØÀ4/ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.892953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.892953		NtWriteFile	buffer => 1€DÄD$2 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.902953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.912953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.922953		NtWriteFile	buffer => 2DÈ41 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.932953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.932953		NtWriteFile	buffer => 3€ÌL$4 .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.942953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.952953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.962953		NtWriteFile	buffer => 4€ÐLD5 .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.972953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.972953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.982953		NtWriteFile	buffer => 5ÐÔ<3.‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:10.992953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.002953		NtWriteFile	buffer => 6€ØD$7 8‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.002953		NtWriteFile	buffer => Èÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.012953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.022953		NtWriteFile	buffer => 7ÈÜ468‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.032953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.032953		NtWriteFile	buffer => 8ۈD$9 (Πfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.042953		NtWriteFile	buffer => Èÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.052953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.062953		NtWriteFile	buffer => 9Èä48(Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.072953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.072953		NtWriteFile	buffer => :€èD$; æŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.082953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.092953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.102953		NtWriteFile	buffer => ;€ì4:æŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.112953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.112953		NtWriteFile	buffer => <€@ð4< file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.122953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.132953		NtWriteFile	buffer => =€4ôL$>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.142953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.152953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.152953		NtWriteFile	buffer => >€4ø4= file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.162953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.172953		NtWriteFile	buffer => ?€üD$@ 6 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.182953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.192953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.202953		NtWriteFile	buffer => @€ 4?6 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.202953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.212953		NtWriteFile	buffer => A D 4A file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.222953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.232953		NtWriteFile	buffer => B€ D$C ]‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.232953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.242953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.252953		NtWriteFile	buffer => C€ 4B]‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.262953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.272953		NtWriteFile	buffer => D€ D$E  Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.272953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.282953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.292953		NtWriteFile	buffer => EÐ 4D Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.302953		NtWriteFile	buffer => ` `` ` ` ` `áýÿÿáýÿÿÆÆþÿÿþÿÿþÿÿþÿÿ þÿÿ þÿÿúýÿÿúýÿÿþýÿÿþýÿÿÿýÿþÿÿþÿÿ ÿýÿÿÿýÿÿ öýÿÿöýÿÿöýÿÿ÷ýÿÿ÷ýÿÿìýÿÿìýÿÿõýÿÿõýÿÿõýÿÿ¼¼ôýÿÿèýÿÿèýÿÿäýÿÿãýÿÿãýÿÿ'' file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.312953		NtWriteFile	buffer => ¼ü$T¤99@@”9”9È%È%¨9¨98;8;L&L&t&t&ˆ&ttØ9Ø9À9À9ì9ì9::::0:0:”:”:¤&¤&ô:ô:H'H'H'`'`'Ð>Ð>”'”'”'L:L:L)L)4@4@8=xx€:€:˜=L@L@h:h: file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.312953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <X€œÄàD`ˆ¤Ìô8T|˜ÀÜ HdŒ¨Ðì0XtœÄà$H`ˆ°Ìô8T|˜°Øô 8 P x ” ¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.322953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.332953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.342953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.342953		NtWriteFile	buffer => xØ `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.352953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.362953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.372953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.372953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.382953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.392953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.402953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.402953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.412953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.422953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.422953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.432953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.442953		NtWriteFile	buffer => ˆØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.452953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.452953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.462953		NtWriteFile	buffer => € ˜Ø €€ €, ¨@ ¸X¸phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.472953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.472953		NtWriteFile	buffer => €D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.482953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.492953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.502953		NtWriteFile	buffer => ˆ 4‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.512953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.512953		NtWriteFile	buffer => €$D$ D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.522953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.532953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.532953		NtWriteFile	buffer => ˆ(4 D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.542953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.552953		NtWriteFile	buffer => €,D$ àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.562953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.572953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.583953		NtWriteFile	buffer => €04àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.583953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.593953		NtWriteFile	buffer => €4D$ ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.603953		NtWriteFile	buffer => Øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.613953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.613953		NtWriteFile	buffer => Ø84 ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.623953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.633953		NtWriteFile	buffer => €4<D$  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.643953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.653953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.653953		NtWriteFile	buffer => €4@4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.663953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.673953		NtWriteFile	buffer => €DD$ zŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.683953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.683953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.693953		NtWriteFile	buffer => €H4zŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.703953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.713953		NtWriteFile	buffer => €LD$ fŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.723953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.723953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.733953		NtWriteFile	buffer => €P4fŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.743953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.753953		NtWriteFile	buffer => €TD$ Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.763953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.763953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.773953		NtWriteFile	buffer => €X4Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.783953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.793953		NtWriteFile	buffer => €\D$ Љ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.803953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.803953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.813953		NtWriteFile	buffer => €`4Љ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.823953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.833953		NtWriteFile	buffer => €dD$ V‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.833953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.843953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.853953		NtWriteFile	buffer => €h4V‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.863953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.873953		NtWriteFile	buffer => €lD$ üŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.883953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:11.943953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.043953		NtWriteFile	buffer => Àp4üŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.123953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.133953		NtWriteFile	buffer => €tD$ ¸ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.223953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.243953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.253953		NtWriteFile	buffer => €x4¸ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.263953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.284953		NtWriteFile	buffer => €|L$ „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.294953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.314953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.324953		NtWriteFile	buffer => €€LD! „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.334953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.334953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.344953		NtWriteFile	buffer => !Є<„Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.354953		NtWriteFile	buffer => ` `` ` ` ` `þÿÿþÿÿÿýÿÿÿýÿÿþýÿÿþýÿÿ÷ýÿÿ÷ýÿÿddeeffgghhiijjöýÿÿöýÿÿöýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.364953		NtWriteFile	buffer => ¼ü$T¤È%È%¤&¤&t&t&`'`'xxd@d@t@t@„@„@œ@œ@´@´@Ô@Ô@ì@ì@H'H'H' file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.364953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <X€œÄà$Lh¬Ôð4\x ¼ä file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.374953		NtWriteFile	buffer => ¬ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.384953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.384953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.394953		NtWriteFile	buffer => ÈØ `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.404953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.414953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.414953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.424953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.434953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.434953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.444953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.454953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.464953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.464953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.474953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.484953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.494953		NtWriteFile	buffer => ØØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.494953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.504953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.514953		NtWriteFile	buffer => € èØ €€ €, ø@ ¸Xphˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.524953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.524953		NtWriteFile	buffer => €D$ ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.534953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.544953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.554953		NtWriteFile	buffer => € 4ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.564953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.564953		NtWriteFile	buffer => €$D$ ^ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.574953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.584953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.594953		NtWriteFile	buffer => €(4 ^ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.604953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.604953		NtWriteFile	buffer => €,D$ àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.614953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.624953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.634953		NtWriteFile	buffer => €04àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.644953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.644953		NtWriteFile	buffer => €4D$ €‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.654953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.664953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.674953		NtWriteFile	buffer => €84 €‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.684953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.684953		NtWriteFile	buffer => €<D$ ¶Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.694953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.704953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.704953		NtWriteFile	buffer => €@4¶Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.714953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.724953		NtWriteFile	buffer => €DD$ ŒŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.734953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.744953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.744953		NtWriteFile	buffer => €H4ŒŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.754953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.764953		NtWriteFile	buffer => €LD$  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.774953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.784953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.784953		NtWriteFile	buffer => €P4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.794953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.804953		NtWriteFile	buffer => €TD$ 2‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.814953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.824953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.824953		NtWriteFile	buffer => €X42‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.834953		NtWriteFile	buffer => ` `` ` ` ` `úýÿÿúýÿÿE €E €þýÿÿþýÿÿ € € € € € €áýÿÿáýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.844953		NtWriteFile	buffer => ¼ü$T¤L&L&ttt&t&99  ¨!¨!""99 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.854953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <X€œÄà$Lh file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.864953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.864953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.874953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.884953		NtWriteFile	buffer => Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.894953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.904953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.904953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.914953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.924953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.934953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.934953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.944953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.954953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.964953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.975953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.975953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.985953		NtWriteFile	buffer => (Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:12.995953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.005953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.015953		NtWriteFile	buffer => € 8Ø €€ €, H@ ¸XXphˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.025953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.025953		NtWriteFile	buffer => €4hˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.035953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.045953		NtWriteFile	buffer =>  € 4ÀŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.055953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.065953		NtWriteFile	buffer => h$L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.065953		NtWriteFile	buffer => €„$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.075953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.085953		NtWriteFile	buffer => h(L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.095953		NtWriteFile	buffer => €49 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.095953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.105953		NtWriteFile	buffer =>  €,D ¶  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.115953		NtWriteFile	buffer => €|# file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.125953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.125953		NtWriteFile	buffer =>  €04 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.135953		NtWriteFile	buffer => @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.145953		NtWriteFile	buffer => h4l z  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.155953		NtWriteFile	buffer => €D9€X9€„$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.165953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.175953		NtWriteFile	buffer => h8\ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.185953		NtWriteFile	buffer => €D9 €X9 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.185953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.195953		NtWriteFile	buffer => h<l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.205953		NtWriteFile	buffer => €D9 €X9 €„$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.215953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.215953		NtWriteFile	buffer => €@D è  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.225953		NtWriteFile	buffer => €|# file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.235953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.245953		NtWriteFile	buffer => €D4Ž  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.255953		NtWriteFile	buffer => ` `` ` ` ` `<üÿÿÿ```B``C> file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.255953		NtWriteFile	buffer => ¼ü$T¤D#X#h$˜$l#X$%p9€9D%œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.265953		NtWriteFile	buffer => 0H`„À Œ ¨ Ä è 4LŒ¼ø  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.275953		NtWriteFile	buffer => ° file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.285953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.295953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.295953		NtWriteFile	buffer => ÐØ `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.435953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.525953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.535953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.545953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.545953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.555953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.565953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.575953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.585953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.585953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.595953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.605953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.615953		NtWriteFile	buffer => àØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.615953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.625953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.635953		NtWriteFile	buffer => € ðØ €€ €, @ ¸X phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.645953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.645953		NtWriteFile	buffer => €D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.655953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.666953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.676953		NtWriteFile	buffer => ˆ 4‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.676953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.686953		NtWriteFile	buffer => €$D$ D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.696953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.696953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.706953		NtWriteFile	buffer => ˆ(4 D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.716953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.726953		NtWriteFile	buffer => €T,L$ ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.726953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.736953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.746953		NtWriteFile	buffer => €0LD ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.746953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.756953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.766953		NtWriteFile	buffer => ¸4<ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.766953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.776953		NtWriteFile	buffer => €T8D$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.786953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.786953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.796953		NtWriteFile	buffer => €T<4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.806953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.806953		NtWriteFile	buffer => €T@D$ þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.816953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.826953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.826953		NtWriteFile	buffer => €TD4þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.836953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.846953		NtWriteFile	buffer => €THD$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.856953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.856953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.866953		NtWriteFile	buffer => €TL4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.876953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.876953		NtWriteFile	buffer => €TPD$ 0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.896953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.906953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.906953		NtWriteFile	buffer => €TT40‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.916953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.926953		NtWriteFile	buffer => €TXD$ &‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.926953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.936953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.946953		NtWriteFile	buffer => €T\4&‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.946953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.956953		NtWriteFile	buffer => €T`D$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.966953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.976953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.976953		NtWriteFile	buffer => €Td4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.986953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.996953		NtWriteFile	buffer => €hD$ àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:13.996953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.006953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.016953		NtWriteFile	buffer => €l4àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.026953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.036953		NtWriteFile	buffer => €pL$ „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.036953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.046953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.056953		NtWriteFile	buffer => €tLD „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.056953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.066953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.076953		NtWriteFile	buffer => Ðx<„Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.086953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.086953		NtWriteFile	buffer => €|D$ ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.096953		NtWriteFile	buffer => Øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.106953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.116953		NtWriteFile	buffer => Ø€4ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.116953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.126953		NtWriteFile	buffer => !€„D$" ¢Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.136953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.146953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.146953		NtWriteFile	buffer => "€ˆ4!¢Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.156953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.166953		NtWriteFile	buffer => #€ŒD$$ <Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.176953		NtWriteFile	buffer =>  ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.186953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.196953		NtWriteFile	buffer => $ 4#<Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.196953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.206953		NtWriteFile	buffer => %€”D$& nŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.216953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.226953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.226953		NtWriteFile	buffer => & ˜4%nŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.236953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.246953		NtWriteFile	buffer => '€œD' file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.256953		NtWriteFile	buffer => €PA file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.266953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.276953		NtWriteFile	buffer => (€ L( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.276953		NtWriteFile	buffer => PA file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.286953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.296953		NtWriteFile	buffer => )€¤D) file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.296953		NtWriteFile	buffer => €¬A file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.306953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.316953		NtWriteFile	buffer => *۬L* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.326953		NtWriteFile	buffer => ¬A file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.336953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.346953		NtWriteFile	buffer => +€¬L+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.346953		NtWriteFile	buffer => B file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.356953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.367953		NtWriteFile	buffer => ,€°4,ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.377953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.387953		NtWriteFile	buffer => -€´L- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.387953		NtWriteFile	buffer => 8B file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.397953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.407953		NtWriteFile	buffer => .€¸4.ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.417953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.427953		NtWriteFile	buffer => /€¼L/ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.427953		NtWriteFile	buffer => lB file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.437953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.447953		NtWriteFile	buffer => 0€À40ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.457953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.467953		NtWriteFile	buffer => 1ۀL1 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.467953		NtWriteFile	buffer =>  B file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.477953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.487953		NtWriteFile	buffer => 2€È42ú‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.497953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.507953		NtWriteFile	buffer => 30 Ì<3xŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.517953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.517953		NtWriteFile	buffer => 4hÐ<4º‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.527953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.537953		NtWriteFile	buffer => 5€ÔD$6  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.547953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.557953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.557953		NtWriteFile	buffer => 6€Ø45 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.567953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.577953		NtWriteFile	buffer => 7ۆD$8 PΠfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.587953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.597953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.597953		NtWriteFile	buffer => 8ۈ47PΠfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.607953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.617953		NtWriteFile	buffer => 9ۊD$: FΠfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.627953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.637953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.637953		NtWriteFile	buffer => :ۏ49FΠfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.647953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.657953		NtWriteFile	buffer => ;€TìD$< :‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.667953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.677953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.677953		NtWriteFile	buffer => <€Tð4;:‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.687953		NtWriteFile	buffer => ` `` ` ` ` `þÿÿþÿÿÿýÿÿÿýÿÿÿýÿþÿÿþÿÿ þýÿÿþýÿÿöýÿÿöýÿÿöýÿÿ÷ýÿÿ÷ýÿÿ   `!`"`#`$`$&`#(`%*`"! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.697953		NtWriteFile	buffer => ¼ü$T¤È%È%¤&¤&ˆ&ttì9ì9Ø9Ø9À9À90:0:::::t&t&H'H'H'`'`'AAô?ô?AA0AlAŒAÈAèABB8BPBlB„B B ¸BxxPAPA¬A¬A”:”: file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.707953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <d€¨Äì0Lt¸Ôü@\„¬Èð4Px”¼Øü DhŒ¨Ìè(Lh„ Èä(Pl” file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.707953		NtWriteFile	buffer =>   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.717953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.727953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.737953		NtWriteFile	buffer => @ Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.747953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.747953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.757953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.767953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.777953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.787953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.787953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.797953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.807953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.817953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.827953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.827953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.837953		NtWriteFile	buffer => P Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.847953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.857953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.867953		NtWriteFile	buffer => € ` Ø €€ €, p @ ¸X€ phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.867953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.877953		NtWriteFile	buffer => €D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.887953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.897953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.907953		NtWriteFile	buffer => ˆ 4‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.917953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.927953		NtWriteFile	buffer => €$D$ D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.927953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.937953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.947953		NtWriteFile	buffer => ˆ(4 D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.957953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.957953		NtWriteFile	buffer => €,D$ àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.967953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.977953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.987953		NtWriteFile	buffer => €04àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.987953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:14.997953		NtWriteFile	buffer => €4D$ ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.017953		NtWriteFile	buffer => Øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.027953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.037953		NtWriteFile	buffer => Ø84 ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.037953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.047953		NtWriteFile	buffer => €4<D$  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.058953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.068953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.078953		NtWriteFile	buffer => €4@4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.078953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.088953		NtWriteFile	buffer => €DD$ zŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.098953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.108953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.108953		NtWriteFile	buffer => €H4zŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.118953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.128953		NtWriteFile	buffer => €LD$ fŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.138953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.138953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.158953		NtWriteFile	buffer => €P4fŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.168953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.178953		NtWriteFile	buffer => €TD$ Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.178953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.188953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.198953		NtWriteFile	buffer => €X4Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.208953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.218953		NtWriteFile	buffer => €\D$ üŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.218953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.228953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.238953		NtWriteFile	buffer => À`4üŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.238953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.248953		NtWriteFile	buffer => €dL$ „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.258953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.268953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.278953		NtWriteFile	buffer => €hLD „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.288953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.288953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.298953		NtWriteFile	buffer => Ðl<„Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.308953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.308953		NtWriteFile	buffer => €pD$ ¸ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.318953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.328953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.338953		NtWriteFile	buffer => €t4¸ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.348953		NtWriteFile	buffer => ` `` ` ` ` `þÿÿþÿÿÿýÿÿÿýÿÿþýÿÿþýÿÿ÷ýÿÿ÷ýÿÿddeeffiiöýÿÿöýÿÿöýÿÿjj file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.348953		NtWriteFile	buffer => ¼ü$T¤È%È%¤&¤&t&t&`'`'xxd@d@t@t@„@„@Ô@Ô@H'H'H'ì@ì@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.358953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <X€œÄà$Lh¬Ôð@\„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.368953		NtWriteFile	buffer => P file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.378953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.388953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.388953		NtWriteFile	buffer =>  Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.398953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.408953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.418953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.418953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.428953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.438953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.448953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.458953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.468953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.468953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.478953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.488953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.498953		NtWriteFile	buffer =>   Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.498953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.508953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.518953		NtWriteFile	buffer => € ° Ø €€ €, À @ ¸XÐ phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.528953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.538953		NtWriteFile	buffer => €D$ àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.538953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.548953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.558953		NtWriteFile	buffer => € 4àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.568953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.578953		NtWriteFile	buffer => €$D$ ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.578953		NtWriteFile	buffer => Øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.588953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.598953		NtWriteFile	buffer => Ø(4 ŽŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.608953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.618953		NtWriteFile	buffer => €,D$ d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.618953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.628953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.638953		NtWriteFile	buffer => €04d‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.648953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.648953		NtWriteFile	buffer => €4D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.658953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.668953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.678953		NtWriteFile	buffer => ˆ84 ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.688953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.688953		NtWriteFile	buffer => €<D$ Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.698953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.708953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.718953		NtWriteFile	buffer => À@4Œ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.728953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.728953		NtWriteFile	buffer => €DD$  ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.738953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.748953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.759953		NtWriteFile	buffer => ˆH4 ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.769953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.769953		NtWriteFile	buffer => €LD$ ´‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.779953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.789953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.799953		NtWriteFile	buffer => P4´‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.809953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.809953		NtWriteFile	buffer => €TL$ .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.819953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.829953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.839953		NtWriteFile	buffer => €XLD .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.839953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.849953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.859953		NtWriteFile	buffer => Ð\<.‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.869953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:15.879953		NtWriteFile	buffer => €`L$ „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:17.952953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:17.982953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:17.992953		NtWriteFile	buffer => €dLD „Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:17.992953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.002953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.012953		NtWriteFile	buffer => Ðh<„Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.022953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.022953		NtWriteFile	buffer => €lD$ Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.032953		NtWriteFile	buffer => èÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.042953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.042953		NtWriteFile	buffer => èp4 Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.052953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.062953		NtWriteFile	buffer => €tD$ $‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.062953		NtWriteFile	buffer => àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.072953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.082953		NtWriteFile	buffer => àx4$‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.092953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.092953		NtWriteFile	buffer => €|D$ L‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.102953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.112953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.112953		NtWriteFile	buffer => €€4L‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.122953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.132953		NtWriteFile	buffer => !€„D$" (Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.132953		NtWriteFile	buffer => ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.142953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.152953		NtWriteFile	buffer => "ðˆ4!(Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.152953		NtWriteFile	buffer => ` `` ` ` ` `þýÿÿþýÿÿ÷ýÿÿ÷ýÿÿþÿÿþÿÿþÿÿþÿÿ þÿÿ þÿÿ þÿÿ þÿÿþÿÿþÿÿõýÿÿõýÿÿõýÿÿöýÿÿöýÿÿöýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.162953		NtWriteFile	buffer => ¼ü$T¤t&t&`'`'”9”9È%È%¨9¨9à%à%ø%ø%”'”'”'H'H'H'¨'¨'x'x'Ä'Ä'L)L) file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.172953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <X€œÄà$Lh¸Ôü$@h„¬Èð4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.172953		NtWriteFile	buffer => ô file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.182953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.192953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.192953		NtWriteFile	buffer => à Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.202953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.212953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.212953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.222953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.232953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.232953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.242953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.252953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.252953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.262953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.272953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.272953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.282953		NtWriteFile	buffer => ð Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.292953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.292953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.302953		NtWriteFile	buffer => € Ø €€ €,  @ ¸X phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.312953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.312953		NtWriteFile	buffer => €D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.322953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.332953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.332953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.342953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.352953		NtWriteFile	buffer => €$D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.352953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.362953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.372953		NtWriteFile	buffer => €(4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.382953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.382953		NtWriteFile	buffer => €,D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.392953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.392953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.402953		NtWriteFile	buffer => €04 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.412953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.412953		NtWriteFile	buffer => €4D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.422953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.432953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.432953		NtWriteFile	buffer => €84 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.442953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.452953		NtWriteFile	buffer => €<D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.452953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.462953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.472953		NtWriteFile	buffer => €@4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.492953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.502953		NtWriteFile	buffer => €@DD$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.512953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.512953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.522953		NtWriteFile	buffer => €@H4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.532953		NtWriteFile	buffer => ` `` ` ` ` `YYZZ[[\\ãýÿÿãýÿÿjj file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.532953		NtWriteFile	buffer => ¼ü$T¤,,L&L&øBøBCC C C4C4C file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.543953		NtWriteFile	buffer => 0H`„À Œ ° È ì (@d| ¸Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.543953		NtWriteFile	buffer => ô file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.553953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.563953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.563953		NtWriteFile	buffer => 0 Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.573953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.573953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.583953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.593953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.593953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.603953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.613953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.613953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.623953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.623953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.633953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.643953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.643953		NtWriteFile	buffer => @ Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.653953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.653953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.663953		NtWriteFile	buffer => € P Ø €€ €, ` @ ¸Xp phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.673953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.673953		NtWriteFile	buffer => €D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.683953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.683953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.693953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.693953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.703953		NtWriteFile	buffer => €$D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.713953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.713953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.723953		NtWriteFile	buffer => €(4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.733953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.733953		NtWriteFile	buffer => €,D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.743953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.743953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.753953		NtWriteFile	buffer => €04 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.763953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.763953		NtWriteFile	buffer => €4D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.773953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.773953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.783953		NtWriteFile	buffer => €84 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.793953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.793953		NtWriteFile	buffer => €<D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.803953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.803953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.813953		NtWriteFile	buffer => €@4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.823953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.823953		NtWriteFile	buffer => €@DD$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.833953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.833953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.843953		NtWriteFile	buffer => €@H4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.853953		NtWriteFile	buffer => ` `` ` ` ` `YY^^[[\\ãýÿÿãýÿÿjj file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.853953		NtWriteFile	buffer => ¼ü$T¤,, , ,øBøBCC C C4C4C file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.863953		NtWriteFile	buffer => 0H`„À Œ ° È ì (@d| ¸Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.873953		NtWriteFile	buffer => @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.873953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.883953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.883953		NtWriteFile	buffer => € Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.963953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:18.973953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.073953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.083953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.113953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.113953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.123953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.133953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.143953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.143953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.163953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.163953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.173953		NtWriteFile	buffer =>  Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.183953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.193953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.193953		NtWriteFile	buffer => €   Ø €€ €, ° @ ¸XÀ phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.203953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.213953		NtWriteFile	buffer => €D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.213953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.223953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.223953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.234953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.244953		NtWriteFile	buffer => €$D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.254953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.254953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.264953		NtWriteFile	buffer => €(4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.274953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.274953		NtWriteFile	buffer => €@,D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.284953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.294953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.304953		NtWriteFile	buffer => €@04 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.304953		NtWriteFile	buffer => ` `` ` ` ` `ZZãýÿÿãýÿÿjj file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.314953		NtWriteFile	buffer => ¼ü$T¤L&L& C C4C4C file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.324953		NtWriteFile	buffer => 0H`„À Œ ° È ì ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.324953		NtWriteFile	buffer => | file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.334953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.344953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.344953		NtWriteFile	buffer => Ð Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.354953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.364953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.364953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.374953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.384953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.384953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.394953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.404953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.404953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.414953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.424953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.424953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.434953		NtWriteFile	buffer => à Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.444953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.444953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.454953		NtWriteFile	buffer => € ð Ø €€ €, @ ¸Xphˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.464953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.464953		NtWriteFile	buffer => €D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.474953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.484953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.484953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.494953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.504953		NtWriteFile	buffer => €$D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.504953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.514953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.524953		NtWriteFile	buffer => €(4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.524953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.534953		NtWriteFile	buffer => €,D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.544953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.544953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.554953		NtWriteFile	buffer => €04 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.564953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.564953		NtWriteFile	buffer => €@4D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.574953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.584953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.584953		NtWriteFile	buffer => €@84 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.594953		NtWriteFile	buffer => ` `` ` ` ` `ãýÿÿãýÿÿ__jj file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.604953		NtWriteFile	buffer => ¼ü$T¤ C CxxHCHC4C4C file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.604953		NtWriteFile	buffer => 0H`„À Œ ° È ì (@d file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.614953		NtWriteFile	buffer => ” file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.624953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.624953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.634953		NtWriteFile	buffer => Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.644953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.644953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.654953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.654953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.664953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.674953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.674953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.684953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.694953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.694953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.704953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.714953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.714953		NtWriteFile	buffer => 0Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.724953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.734953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.734953		NtWriteFile	buffer => € @Ø €€ €, P@ ¸X`phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.744953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.744953		NtWriteFile	buffer => €D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.754953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.754953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.764953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.774953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.774953		NtWriteFile	buffer => €$D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.784953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.784953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.794953		NtWriteFile	buffer => €(4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.804953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.804953		NtWriteFile	buffer => €,D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.814953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.814953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.824953		NtWriteFile	buffer => €04 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.824953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.834953		NtWriteFile	buffer => €@4D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.844953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.844953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.854953		NtWriteFile	buffer => €@84 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.864953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.864953		NtWriteFile	buffer =>  @<4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.874953		NtWriteFile	buffer => ` `` ` ` ` `ãýÿÿãýÿÿ__jjäýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.884953		NtWriteFile	buffer => ¼ü$T¤ C CxxHCHC4C4C˜= file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.884953		NtWriteFile	buffer => 0H`„À Œ ° È ì (@d| file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.894953		NtWriteFile	buffer => ¸ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.894953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.904953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.914953		NtWriteFile	buffer => pØ `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.914953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.925953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.935953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.935953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.945953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.945953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.955953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.965953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.965953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.975953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.975953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.985953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.985953		NtWriteFile	buffer => €Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:19.995953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.005953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.025953		NtWriteFile	buffer => € Ø €€ €,  @ ¸X°phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.035953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.035953		NtWriteFile	buffer => €D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.045953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.055953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.055953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.065953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.065953		NtWriteFile	buffer => €$D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.075953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.085953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.085953		NtWriteFile	buffer => €(4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.095953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.105953		NtWriteFile	buffer => €,D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.105953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.115953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.125953		NtWriteFile	buffer => €04 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.125953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.135953		NtWriteFile	buffer => €4D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.135953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.155953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.155953		NtWriteFile	buffer => €84 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.165953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.175953		NtWriteFile	buffer => €@<D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.175953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.185953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.195953		NtWriteFile	buffer => €@@4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.195953		NtWriteFile	buffer => ` `` ` ` ` `ãýÿÿãýÿÿaabbjj file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.205953		NtWriteFile	buffer => ¼ü$T¤ C Cxx@<@<4"4"4C4C file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.215953		NtWriteFile	buffer => 0H`„À Œ ° È ì (@d|  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.215953		NtWriteFile	buffer => @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.225953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.235953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.235953		NtWriteFile	buffer => ÀØ `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.245953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.255953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.265953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.265953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.275953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.285953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.295953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.295953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.305953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.315953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.315953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.325953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.335953		NtWriteFile	buffer => ÐØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.335953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.345953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.355953		NtWriteFile	buffer => € àØ €€ €, ð@ ¸Xphˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.355953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.365953		NtWriteFile	buffer => €D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.375953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.375953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.385953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.395953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.395953		NtWriteFile	buffer => €$D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.405953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.415953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.415953		NtWriteFile	buffer => €(4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.425953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.435953		NtWriteFile	buffer => €@,D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.445953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.445953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.455953		NtWriteFile	buffer => €@04 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.465953		NtWriteFile	buffer => ` `` ` ` ` `ãýÿÿãýÿÿjj file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.465953		NtWriteFile	buffer => ¼ü$T¤ C Cxx4C4C file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.475953		NtWriteFile	buffer => 0H`„À Œ ° È ì ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.485953		NtWriteFile	buffer => ¸ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.485953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.495953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.495953		NtWriteFile	buffer => Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.505953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.515953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.515953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.525953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.535953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.535953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.545953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.555953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.555953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.565953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.575953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.575953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.585953		NtWriteFile	buffer => Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.595953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.595953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.605953		NtWriteFile	buffer => € 0Ø €€ €, @@ ¸XPphˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.615953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.615953		NtWriteFile	buffer => €D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.626953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.626953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.636953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.646953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.646953		NtWriteFile	buffer => €$D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.656953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.656953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.666953		NtWriteFile	buffer => €(4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.676953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.686953		NtWriteFile	buffer => €,D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.686953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.696953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.706953		NtWriteFile	buffer => €04 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.716953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.716953		NtWriteFile	buffer => €4D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.726953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.726953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.736953		NtWriteFile	buffer => €84 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.746953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.746953		NtWriteFile	buffer => €@<D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.756953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.766953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.766953		NtWriteFile	buffer => €@@4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.776953		NtWriteFile	buffer => ` `` ` ` ` `ãýÿÿãýÿÿaabbjj file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.786953		NtWriteFile	buffer => ¼ü$T¤ C Cxx@<@<4"4"4C4C file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.786953		NtWriteFile	buffer => 0H`„À Œ ° È ì (@d|  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.796953		NtWriteFile	buffer => ô file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.806953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.806953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.816953		NtWriteFile	buffer => `Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.816953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.826953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.836953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.836953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.846953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.856953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.856953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.866953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.876953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.876953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.886953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:20.946953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.016953		NtWriteFile	buffer => pØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.076953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.096953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.096953		NtWriteFile	buffer => € €Ø €€ €, @ ¸X phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.106953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.116953		NtWriteFile	buffer => €D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.116953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.126953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.136953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.136953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.146953		NtWriteFile	buffer => €$L$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.146953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.156953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.166953		NtWriteFile	buffer => €(4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.166953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.176953		NtWriteFile	buffer => €,L$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.176953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.186953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.186953		NtWriteFile	buffer => €04 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.216953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.226953		NtWriteFile	buffer => €4D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.226953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.236953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.246953		NtWriteFile	buffer => €84 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.246953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.256953		NtWriteFile	buffer => €<D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.266953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.266953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.276953		NtWriteFile	buffer => €@4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.286953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.286953		NtWriteFile	buffer => €DD$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.296953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.296953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.306953		NtWriteFile	buffer => €H4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.317953		NtWriteFile	buffer => ` `` ` ` ` `ãýÿÿãýÿÿccddeeffkk file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.317953		NtWriteFile	buffer => ¼ü$T¤ C C\C\CpCpC8)8)Ð>Ð>ÄÄ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.327953		NtWriteFile	buffer => 0H`„À Œ ° È ì (@d| ¸Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.337953		NtWriteFile	buffer => ¸ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.337953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.347953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.347953		NtWriteFile	buffer => °Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.357953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.367953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.367953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.377953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.387953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.387953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.397953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.397953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.407953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.407953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.417953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.427953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.427953		NtWriteFile	buffer => ÀØ ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.437953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.437953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.447953		NtWriteFile	buffer => € ÐØ €€ €, à@ ¸Xðphˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.447953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.457953		NtWriteFile	buffer => €D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.467953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.467953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.477953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.477953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.487953		NtWriteFile	buffer => €$D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.497953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.497953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.507953		NtWriteFile	buffer => €(4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.507953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.517953		NtWriteFile	buffer => €,D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.517953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.527953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.537953		NtWriteFile	buffer => €04 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.537953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.547953		NtWriteFile	buffer => €4D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.547953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.557953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.557953		NtWriteFile	buffer => €84 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.567953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.577953		NtWriteFile	buffer => €<D$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.577953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.587953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.597953		NtWriteFile	buffer => €@4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.597953		NtWriteFile	buffer => ` `` ` ` ` `ãýÿÿãýÿÿgghhii file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.607953		NtWriteFile	buffer => ¼ü$T¤ C CxxŒCŒCœCœC€:€: file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.607953		NtWriteFile	buffer => 0H`„À Œ ° È ì (@d|  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.617953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.627953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.627953		NtWriteFile	buffer => €¼ž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.637953		NtWriteFile	buffer => 0D „+ €”+ €¤+ À: (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.637953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.647953		NtWriteFile	buffer => €¼ ¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.647953		NtWriteFile	buffer => 0D 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.657953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.667953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.667953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.677953		NtWriteFile	buffer => €L Є file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.687953		NtWriteFile	buffer => 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.687953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.697953		NtWriteFile	buffer => €´ä„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.697953		NtWriteFile	buffer => €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.707953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.707953		NtWriteFile	buffer => €t*  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.717953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.727953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.727953		NtWriteFile	buffer => €t4  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.737953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.737953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.747953		NtWriteFile	buffer => €t>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.757953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.757953		NtWriteFile	buffer => ¨ýÿÿ§ýÿÿ ýÿÿ£ýÿÿ¢ýÿÿ¡ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.767953		NtWriteFile	buffer => h+ð+$,8,L,`-Œ-¤- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.767953		NtWriteFile	buffer => pàü$ ” à , file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.777953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.787953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.787953		NtWriteFile	buffer => €¼ž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.797953		NtWriteFile	buffer => 0D „+ €”+ €¤+ À: (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.797953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.807953		NtWriteFile	buffer => €¼ ¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.817953		NtWriteFile	buffer => 0D 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.817953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.827953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.827953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.837953		NtWriteFile	buffer => €L Є file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.847953		NtWriteFile	buffer => 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.847953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.857953		NtWriteFile	buffer => €´ä„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.867953		NtWriteFile	buffer => €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.867953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.877953		NtWriteFile	buffer => €\ø„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.887953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.887953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.937953		NtWriteFile	buffer => €L   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.947953		NtWriteFile	buffer => P8- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.957953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.957953		NtWriteFile	buffer => €\  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.967953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.977953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.977953		NtWriteFile	buffer => € t*  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.987953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.987953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.997953		NtWriteFile	buffer => €$t 4  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:21.997953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.007953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.018953		NtWriteFile	buffer => €(t >  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.018953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.028953		NtWriteFile	buffer => ¨ýÿÿ§ýÿÿ ýÿÿ¦ýÿÿ¥ýÿÿ¤ýÿÿ£ýÿÿ¢ýÿÿ¡ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.028953		NtWriteFile	buffer => h+ð+$,8,L,ü,$-L-`-Œ-¤- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.038953		NtWriteFile	buffer => pàü$ ” È ð $p¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.048953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.048953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.068953		NtWriteFile	buffer => €¼ž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.078953		NtWriteFile	buffer => 0D „+ €”+ €¤+ À: (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.078953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.088953		NtWriteFile	buffer => €¼ ¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.088953		NtWriteFile	buffer => 0D 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.098953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.108953		NtWriteFile	buffer => €4¼„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.108953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.118953		NtWriteFile	buffer => €L Є file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.128953		NtWriteFile	buffer => 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.128953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.138953		NtWriteFile	buffer => €4ڄ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.148953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.148953		NtWriteFile	buffer => €´ä„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.158953		NtWriteFile	buffer => €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.168953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.168953		NtWriteFile	buffer => €\ø„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.178953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.178953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.188953		NtWriteFile	buffer => €L   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.198953		NtWriteFile	buffer => P8- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.198953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.208953		NtWriteFile	buffer => € \  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.218953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.218953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.228953		NtWriteFile	buffer => €$t *  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.238953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.238953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.248953		NtWriteFile	buffer => €(t 4  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.258953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.258953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.268953		NtWriteFile	buffer => €,t>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.278953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.278953		NtWriteFile	buffer => §ýÿÿÒ ýÿÿ¦ýÿÿ¥ýÿÿ¤ýÿÿ£ýÿÿ¢ýÿÿ¡ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.288953		NtWriteFile	buffer => h+ð+°=8,Ä=L,ü,$-L-`-Œ-¤- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.298953		NtWriteFile	buffer => pàü$ @ ° ä @ŒØ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.298953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.308953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.308953		NtWriteFile	buffer => €¼ž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.318953		NtWriteFile	buffer => 0D „+ €”+ €¤+ À: (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.328953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.338953		NtWriteFile	buffer => €¼ ¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.338953		NtWriteFile	buffer => 0D 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.348953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.358953		NtWriteFile	buffer => €4¼„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.358953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.368953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.378953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.378953		NtWriteFile	buffer => €L Є file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.388953		NtWriteFile	buffer => 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.398953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.398953		NtWriteFile	buffer => €´ä„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.408953		NtWriteFile	buffer => €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.418953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.418953		NtWriteFile	buffer => €\ø„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.428953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.428953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.438953		NtWriteFile	buffer => €L   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.448953		NtWriteFile	buffer => P8- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.448953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.458953		NtWriteFile	buffer => € \  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.468953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.478953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.478953		NtWriteFile	buffer => €$t *  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.488953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.498953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.498953		NtWriteFile	buffer => €(t 4  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.508953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.518953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.518953		NtWriteFile	buffer => €,t>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.528953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.538953		NtWriteFile	buffer => žýÿÿ§ýÿÿ ýÿÿ¦ýÿÿ¥ýÿÿ¤ýÿÿ£ýÿÿ¢ýÿÿ¡ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.538953		NtWriteFile	buffer => h+ð+°=$,8,L,ü,$-L-`-Œ-¤- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.548953		NtWriteFile	buffer => pàü @ ° ä @ŒØ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.548953		NtWriteFile	buffer => @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.558953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.568953		NtWriteFile	buffer => €¼ž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.568953		NtWriteFile	buffer => 0D „+ €”+ €¤+ À: (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.578953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.588953		NtWriteFile	buffer => €¼ ¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.588953		NtWriteFile	buffer => 0D 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.598953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.608953		NtWriteFile	buffer => €4¼„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.608953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.618953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.628953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.628953		NtWriteFile	buffer => €L Є file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.638953		NtWriteFile	buffer => 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.638953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.648953		NtWriteFile	buffer => €4ڄ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.658953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.658953		NtWriteFile	buffer => €´ä„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.668953		NtWriteFile	buffer => €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.678953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.678953		NtWriteFile	buffer => €\ø„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.688953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.688953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.698953		NtWriteFile	buffer => € L   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.709953		NtWriteFile	buffer => P8- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.709953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.719953		NtWriteFile	buffer => €$\   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.719953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.729953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.739953		NtWriteFile	buffer => €(t *  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.739953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.749953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.749953		NtWriteFile	buffer => €,t4  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.759953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.769953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.769953		NtWriteFile	buffer => €0t>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.779953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.779953		NtWriteFile	buffer => žýÿÿ§ýÿÿÒ ýÿÿ¦ýÿÿ¥ýÿÿ¤ýÿÿ£ýÿÿ¢ýÿÿ¡ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.789953		NtWriteFile	buffer => h+ð+°=$,8,Ä=L,ü,$-L-`-Œ-¤- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.799953		NtWriteFile	buffer => pàü @ \ Ì (\¨ô file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.799953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.809953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.809953		NtWriteFile	buffer => €¼ž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.819953		NtWriteFile	buffer => 0D „+ €”+ €¤+ À: (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.829953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.829953		NtWriteFile	buffer => €¼ ¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.839953		NtWriteFile	buffer => 0D 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.839953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.849953		NtWriteFile	buffer => €4¼„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.859953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.859953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.869953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.879953		NtWriteFile	buffer => €L Є file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.879953		NtWriteFile	buffer => 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.889953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.889953		NtWriteFile	buffer => €´ä„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.899953		NtWriteFile	buffer => €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.909953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.909953		NtWriteFile	buffer => €\ø„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.919953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.929953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.929953		NtWriteFile	buffer => €L   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.939953		NtWriteFile	buffer => P8- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.949953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.949953		NtWriteFile	buffer => € \  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.959953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.959953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.969953		NtWriteFile	buffer => €$t *  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.979953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.979953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.989953		NtWriteFile	buffer => €(t 4  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.999953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:22.999953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.009953		NtWriteFile	buffer => €,t>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.009953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.019953		NtWriteFile	buffer => žýÿÿ§ýÿÿ ýÿÿ¦ýÿÿ¥ýÿÿ¤ýÿÿ£ýÿÿ¢ýÿÿ¡ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.019953		NtWriteFile	buffer => h+ð+°=$,8,L,ü,$-L-`-Œ-¤- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.029953		NtWriteFile	buffer => pàü @ ° ä @ŒØ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.039953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.039953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.049953		NtWriteFile	buffer => €¼ž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.049953		NtWriteFile	buffer => 0D „+ €”+ €¤+ À: (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.059953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.069953		NtWriteFile	buffer => €¼ ¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.069953		NtWriteFile	buffer => 0D 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.079953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.089953		NtWriteFile	buffer => €4¼„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.089953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.099953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.099953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.109953		NtWriteFile	buffer => €L Є file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.109953		NtWriteFile	buffer => 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.119953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.129953		NtWriteFile	buffer => €´ä„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.129953		NtWriteFile	buffer => €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.139953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.149953		NtWriteFile	buffer => €\ø„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.149953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.159953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.159953		NtWriteFile	buffer => €L   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.169953		NtWriteFile	buffer => P8- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.169953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.179953		NtWriteFile	buffer => € \  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.189953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.189953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.199953		NtWriteFile	buffer => €$t *  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.209953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.209953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.219953		NtWriteFile	buffer => €(t 4  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.219953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.229953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.229953		NtWriteFile	buffer => €,t>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.239953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.249953		NtWriteFile	buffer => žýÿÿ§ýÿÿ ýÿÿ¦ýÿÿ¥ýÿÿ¤ýÿÿ£ýÿÿ¢ýÿÿ¡ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.249953		NtWriteFile	buffer => h+ð+°=$,8,L,ü,$-L-`-Œ-¤- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.259953		NtWriteFile	buffer => pàü @ ° ä @ŒØ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.269953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.269953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.279953		NtWriteFile	buffer => €¼ž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.279953		NtWriteFile	buffer => 0D „+ €”+ €¤+ À: (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.289953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.289953		NtWriteFile	buffer => €¼ ¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.299953		NtWriteFile	buffer => 0D 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.309953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.309953		NtWriteFile	buffer => €4¼„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.319953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.319953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.329953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.339953		NtWriteFile	buffer => €L Є file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.339953		NtWriteFile	buffer => 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.349953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.349953		NtWriteFile	buffer => €´ä„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.359953		NtWriteFile	buffer => €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.359953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.369953		NtWriteFile	buffer => €\ø„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.379953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.379953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.389953		NtWriteFile	buffer => €L   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.389953		NtWriteFile	buffer => P8- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.399953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.410953		NtWriteFile	buffer => € \  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.410953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.420953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.420953		NtWriteFile	buffer => €$t *  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.430953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.440953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.440953		NtWriteFile	buffer => €(t 4  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.450953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.450953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.460953		NtWriteFile	buffer => €,t>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.460953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.470953		NtWriteFile	buffer => žýÿÿ§ýÿÿ ýÿÿ¦ýÿÿ¥ýÿÿ¤ýÿÿ£ýÿÿ¢ýÿÿ¡ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.480953		NtWriteFile	buffer => h+ð+°=$,8,L,ü,$-L-`-Œ-¤- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.480953		NtWriteFile	buffer => pàü @ ° ä @ŒØ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.490953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.490953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.500953		NtWriteFile	buffer => €¼ž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.510953		NtWriteFile	buffer => 0D „+ €”+ €¤+ À: (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.510953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.520953		NtWriteFile	buffer => €¼ ¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.520953		NtWriteFile	buffer => 0D 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.530953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.540953		NtWriteFile	buffer => €4¼„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.540953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.550953		NtWriteFile	buffer => €´ä„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.550953		NtWriteFile	buffer => €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.560953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.570953		NtWriteFile	buffer => €\ø„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.570953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.580953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.580953		NtWriteFile	buffer => €L   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.590953		NtWriteFile	buffer => P8- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.600953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.600953		NtWriteFile	buffer => €\  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.610953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.620953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.620953		NtWriteFile	buffer => €4R  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.630953		NtWriteFile	buffer =>  ýÿÿ¦ýÿÿ¥ýÿÿ¤ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.630953		NtWriteFile	buffer => h+ð+°=L,ü,$-L-Ü) file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.640953		NtWriteFile	buffer => pàül   È ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.650953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.650953		NtWriteFile	buffer => | file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.660953		NtWriteFile	buffer => €Ìž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.660953		NtWriteFile	buffer => €9 0D „+ €”+ €¤+ À: (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.670953		NtWriteFile	buffer => | file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.670953		NtWriteFile	buffer => €Ì ¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.680953		NtWriteFile	buffer => €9 0D 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.690953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.690953		NtWriteFile	buffer => €4¼„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.700953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.710953		NtWriteFile	buffer => €D Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.710953		NtWriteFile	buffer => €9 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.720953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.720953		NtWriteFile	buffer => €\Є file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.730953		NtWriteFile	buffer => €9 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.730953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.740953		NtWriteFile	buffer => €´ä„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.750953		NtWriteFile	buffer => €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.750953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.760953		NtWriteFile	buffer => €\ø„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.760953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.770953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.780953		NtWriteFile	buffer => €L   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.780953		NtWriteFile	buffer => P8- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.790953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.800953		NtWriteFile	buffer => € \  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.800953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.810953		NtWriteFile	buffer => X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.810953		NtWriteFile	buffer => €$„ *  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.820953		NtWriteFile	buffer => €9 €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.830953		NtWriteFile	buffer => X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.830953		NtWriteFile	buffer => €(„ 4  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.840953		NtWriteFile	buffer => €9 €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.840953		NtWriteFile	buffer => X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.850953		NtWriteFile	buffer => €,„>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.860953		NtWriteFile	buffer => €9 €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.860953		NtWriteFile	buffer => ¨ýÿÿ§ýÿÿ ýÿÿ¦ýÿÿ¥ýÿÿ¤ýÿÿ£ýÿÿ¢ýÿÿ¡ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.870953		NtWriteFile	buffer => h+ð+°=$,8,L,ü,$-L-`-Œ-¤- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.880953		NtWriteFile	buffer => |ø < p à <pÈ  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.880953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.890953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:23.940953		NtWriteFile	buffer => €¼ž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.010953		NtWriteFile	buffer => 0D „+ €”+ €¤+ À: (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.020953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.060953		NtWriteFile	buffer => €¼ ¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.111953		NtWriteFile	buffer => 0D 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.131953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.141953		NtWriteFile	buffer => €4¼„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.151953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.151953		NtWriteFile	buffer => €´ä„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.161953		NtWriteFile	buffer => €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.171953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.171953		NtWriteFile	buffer => €\ø„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.181953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.181953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.191953		NtWriteFile	buffer => €L   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.191953		NtWriteFile	buffer => P8- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.201953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.201953		NtWriteFile	buffer => €\  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.211953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.221953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.221953		NtWriteFile	buffer => €4f  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.231953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.241953		NtWriteFile	buffer => € 4\  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.241953		NtWriteFile	buffer =>  ýÿÿ¦ýÿÿ¥ýÿÿ¤ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.251953		NtWriteFile	buffer => h+ð+°=L,ü,$-L-ÐBäB file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.251953		NtWriteFile	buffer => pàül   È ü  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.261953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.271953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.271953		NtWriteFile	buffer => €¼ž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.281953		NtWriteFile	buffer => 0D „+ €”+ €¤+ À: (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.281953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.291953		NtWriteFile	buffer => €¼ ¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.301953		NtWriteFile	buffer => 0D 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.301953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.311953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.321953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.331953		NtWriteFile	buffer => €L Є file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.331953		NtWriteFile	buffer => 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.341953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.341953		NtWriteFile	buffer => €´ä„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.351953		NtWriteFile	buffer => €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.361953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.361953		NtWriteFile	buffer => €t*  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.371953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.381953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.381953		NtWriteFile	buffer => €t4  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.391953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.401953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.401953		NtWriteFile	buffer => €t>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.411953		NtWriteFile	buffer => €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.421953		NtWriteFile	buffer => ¨ýÿÿ§ýÿÿ ýÿÿ£ýÿÿ¢ýÿÿ¡ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.421953		NtWriteFile	buffer => h+ð+$,8,L,`-Œ-¤- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.431953		NtWriteFile	buffer => pàü$ ” à , file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.441953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.441953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.451953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.451953		NtWriteFile	buffer => ¨ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.461953		NtWriteFile	buffer => $, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.471953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.471953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.481953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.491953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.501953		NtWriteFile	buffer => ¨ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.501953		NtWriteFile	buffer => $, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.511953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.511953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.521953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.531953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.531953		NtWriteFile	buffer => ¨ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.541953		NtWriteFile	buffer => $, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.551953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.551953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.561953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.571953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.571953		NtWriteFile	buffer => ¨ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.581953		NtWriteFile	buffer => $, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.591953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.591953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.591953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.601953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.611953		NtWriteFile	buffer => ¨ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.621953		NtWriteFile	buffer => $, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.621953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.631953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.641953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.651953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.651953		NtWriteFile	buffer => ¨ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.661953		NtWriteFile	buffer => $, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.661953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.671953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.681953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.681953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.691953		NtWriteFile	buffer => ¨ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.701953		NtWriteFile	buffer => $, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.701953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.711953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.721953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.721953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.731953		NtWriteFile	buffer => ¨ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.731953		NtWriteFile	buffer => $, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.741953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.751953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.751953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.761953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.771953		NtWriteFile	buffer => ¨ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.771953		NtWriteFile	buffer => $, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.781953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.791953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.802953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.802953		NtWriteFile	buffer => €4Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.812953		NtWriteFile	buffer => ¨ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.822953		NtWriteFile	buffer => $, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.822953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.832953		NtWriteFile	buffer => l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.842953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.842953		NtWriteFile	buffer => €4Œö³D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.852953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.862953		NtWriteFile	buffer => €4 Œì³  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.872953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.872953		NtWriteFile	buffer => €4Œâ³¬ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.882953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.892953		NtWriteFile	buffer => €4ŒÎ³¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.892953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.902953		NtWriteFile	buffer => €4ŒØ³È file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.912953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.912953		NtWriteFile	buffer => €4Œ¦³Ø file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.922953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.932953		NtWriteFile	buffer => €4Œº³ä file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.932953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.942953		NtWriteFile	buffer => €4Œ°³ô file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.942953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.952953		NtWriteFile	buffer => €4ŒÄ³ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.962953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.962953		NtWriteFile	buffer => €4 Œ´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.972953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.972953		NtWriteFile	buffer => €4 Œ´ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.982953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.982953		NtWriteFile	buffer => €4Œ´$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:24.992953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.002953		NtWriteFile	buffer => €4Œ ´0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.002953		NtWriteFile	buffer => @ @@@@@@@@ @ @@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.012953		NtWriteFile	buffer => °CÔCüC(DPD|D¤DÐDøD$EHEpE˜E file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.012953		NtWriteFile	buffer => 8TpŒ¨Äàü 4 P file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.032953		NtWriteFile	buffer => L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.032953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.042953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.052953		NtWriteFile	buffer => Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.052953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.062953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.062953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.072953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.082953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.082953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.092953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.092953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.102953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.112953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.112953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.122953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.132953		NtWriteFile	buffer =>  Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.132953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.212953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.272953		NtWriteFile	buffer => € Ø €€ €, 0 @ ¸X@ phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.342953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.342953		NtWriteFile	buffer =>  <Jˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.352953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.362953		NtWriteFile	buffer =>  @ <¦‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.372953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.382953		NtWriteFile	buffer => $< <‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.392953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.402953		NtWriteFile	buffer => €(4 ҇ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.402953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.412953		NtWriteFile	buffer => €,4܇ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.422953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.422953		NtWriteFile	buffer => €04æ‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.432953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.432953		NtWriteFile	buffer => €4D$ ¤ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.442953		NtWriteFile	buffer => ¨ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.452953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.452953		NtWriteFile	buffer => ¨84 ¤ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.462953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.472953		NtWriteFile	buffer => €<D$ ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.472953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.482953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.482953		NtWriteFile	buffer => €@4ð‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.493953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.503953		NtWriteFile	buffer => €DD$ ^ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.513953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.513953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.523953		NtWriteFile	buffer => €H4^ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.533953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.533953		NtWriteFile	buffer => €LD$ àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.543953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.553953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.553953		NtWriteFile	buffer => €P4àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.563953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.573953		NtWriteFile	buffer => €TD$ €‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.573953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.583953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.593953		NtWriteFile	buffer => €X4€‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.593953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.603953		NtWriteFile	buffer => €\L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.613953		NtWriteFile	buffer => Ø& file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.623953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.623953		NtWriteFile	buffer => €`4”‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.633953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.643953		NtWriteFile	buffer => €dL file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.643953		NtWriteFile	buffer => ' file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.653953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.663953		NtWriteFile	buffer => €h4ž‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.673953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.673953		NtWriteFile	buffer => €lD$ Ɖ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.683953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.693953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.693953		NtWriteFile	buffer => Àp4Ɖ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.703953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.713953		NtWriteFile	buffer => €tD$ ¶Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.713953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.723953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.733953		NtWriteFile	buffer => €x4¶Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.743953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.743953		NtWriteFile	buffer => €|D$ $‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.753953		NtWriteFile	buffer => àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.763953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.793953		NtWriteFile	buffer => à€4$‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.803953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.803953		NtWriteFile	buffer => !€„L$" .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.813953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.823953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.833953		NtWriteFile	buffer => "€ˆLD# .‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.833953		NtWriteFile	buffer => Ðÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.843953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.853953		NtWriteFile	buffer => #ÐŒ<!.‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.863953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.873953		NtWriteFile	buffer => $€D$% B‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.873953		NtWriteFile	buffer => èÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.883953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.893953		NtWriteFile	buffer => %è”4$B‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.903953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.913953		NtWriteFile	buffer => &€˜D$' L‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.913953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.923953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.933953		NtWriteFile	buffer => '€œ4&L‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.943953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.953953		NtWriteFile	buffer => (€ D$) t‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.953953		NtWriteFile	buffer => Àÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.963953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.973953		NtWriteFile	buffer => )À¤4(t‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.973953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.983953		NtWriteFile	buffer => *۬D* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:25.993953		NtWriteFile	buffer => €( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.003953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.003953		NtWriteFile	buffer => +€¬L+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.013953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.023953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.033953		NtWriteFile	buffer => ,€°D$- ~‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.033953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.043953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.053953		NtWriteFile	buffer => -€´4,~‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.063953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.063953		NtWriteFile	buffer => .€¸D. file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.073953		NtWriteFile	buffer => €d( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.083953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.083953		NtWriteFile	buffer => /€¼L/ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.093953		NtWriteFile	buffer => d( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.103953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.113953		NtWriteFile	buffer => 0€ÀD$1 ˆ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.113953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.123953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.133953		NtWriteFile	buffer => 1€Ä40ˆ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.133953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.143953		NtWriteFile	buffer => 2€ÈD2 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.153953		NtWriteFile	buffer => €´( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.153953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.163953		NtWriteFile	buffer => 3€ÌL3 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.173953		NtWriteFile	buffer => ´( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.173953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.184953		NtWriteFile	buffer => 4€ÐD$5 ’‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.194953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.194953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.204953		NtWriteFile	buffer => 5€Ô44’‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.214953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.224953		NtWriteFile	buffer => 6ۯD6 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.224953		NtWriteFile	buffer => €) file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.234953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.244953		NtWriteFile	buffer => 7ۆL7 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.244953		NtWriteFile	buffer => ) file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.254953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.264953		NtWriteFile	buffer => 8€àD$9 œ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.264953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.274953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.284953		NtWriteFile	buffer => 9€ä48œ‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.284953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.294953		NtWriteFile	buffer => :€èD$; ŒŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.304953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.304953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.314953		NtWriteFile	buffer => ;€ì4:ŒŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.324953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.334953		NtWriteFile	buffer => <€ðD$= Ҍ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.334953		NtWriteFile	buffer => H ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.344953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.354953		NtWriteFile	buffer => =H ô4<Ҍ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.364953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.364953		NtWriteFile	buffer => >€øD$? ܌ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.374953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.374953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.384953		NtWriteFile	buffer => ?€ü4>܌ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.394953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.404953		NtWriteFile	buffer => @€ D$A  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.404953		NtWriteFile	buffer => øÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.414953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.424953		NtWriteFile	buffer => Aø 4@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.424953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.434953		NtWriteFile	buffer => B€ D$C  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.444953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.444953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.454953		NtWriteFile	buffer => C€ 4B file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.464953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.474953		NtWriteFile	buffer => D€ D$E @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.474953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.484953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.494953		NtWriteFile	buffer => E€ 4D@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.494953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.504953		NtWriteFile	buffer => F€T D$G ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.514953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.524953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.524953		NtWriteFile	buffer => GT 4Fˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.534953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.544953		NtWriteFile	buffer => H€T D$I file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.554953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.564953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.564953		NtWriteFile	buffer => IT$ 4H file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.574953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.584953		NtWriteFile	buffer => J€T( D$K ö‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.594953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.594953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.604953		NtWriteFile	buffer => KT, 4Jö‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.614953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.624953		NtWriteFile	buffer => L€T0 D$M Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.624953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.634953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.644953		NtWriteFile	buffer => MT4 4LΠfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.654953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.654953		NtWriteFile	buffer => N€T8 D$O N‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.664953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.674953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.674953		NtWriteFile	buffer => O€T< 4NN‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.684953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.694953		NtWriteFile	buffer => P€@ DP file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.704953		NtWriteFile	buffer => €°* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.704953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.714953		NtWriteFile	buffer => Q€D LQ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.724953		NtWriteFile	buffer => °* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.734953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.734953		NtWriteFile	buffer => R€TH D$S X‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.744953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.754953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.764953		NtWriteFile	buffer => S€TL 4RX‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.774953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.774953		NtWriteFile	buffer => T€P DT file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.784953		NtWriteFile	buffer => €ô* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.794953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.804953		NtWriteFile	buffer => U€T LU file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.804953		NtWriteFile	buffer => ô* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.814953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.824953		NtWriteFile	buffer => V€X 4V˜  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.834953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.844953		NtWriteFile	buffer => W€\ 4W¢  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.844953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.854953		NtWriteFile	buffer => X€` 4XÊ  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.864953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.874953		NtWriteFile	buffer => Y€d 4YÔ  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.885953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.885953		NtWriteFile	buffer => Z€h 4Zü  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.895953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.905953		NtWriteFile	buffer => [€l T[† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.915953		NtWriteFile	buffer => €ð)€* file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.925953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.925953		NtWriteFile	buffer => \€p 4\$† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.935953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.945953		NtWriteFile	buffer => ]€t 4]B† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.955953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.965953		NtWriteFile	buffer => ^€x D$_ 2‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.965953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.975953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.985953		NtWriteFile	buffer => _€| 4^2‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.995953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:26.995953		NtWriteFile	buffer => ` €€ 4`‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.005953		NtWriteFile	buffer => ` `` ` ` ` `     úýÿÿúýÿÿE €E €þýÿÿþýÿÿñ €ñ €` `   € €õýÿÿõýÿÿõýÿÿ #`$` '`(`  +`,`  /`0`  € € ñ € ñ €ñ €ñ €   € €  € €   ‚ ‚ ƒ ƒ „ „ I`J` M`N` áýÿÿáýÿÿ € file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.015953		NtWriteFile	buffer => ¼ü$T¤ø8)¬%&$&8&`&`&L&L&ttt&t&99¼&Ø&ð&'$'$'  x'x'”'”'”'¨'¨'Ä'Ä'à'à'ø',(((H(|(d(d(˜(Ì(´(´(è()))¨!¨!ÀEÀEÜEÜEh)h)""Œ)Œ)P*P*h*h*€*€*˜*˜*°*°*Ä*Ü*ô*ô*+ +8$H$œ)°)È)Ü)*8*998! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.025953		NtWriteFile	buffer => 0H`„À Œ ¨ Ä à ü 4\x ¼ä(Dlˆ¬Èì0Lt¸Ôü$@h„¬Èð0T|˜¼à$Hl”°Ôø <d€¨Äì 0 L t  ¸ Ô ü  < T | ˜ À Ü  Dh¬Ðô,Hd€´Ðì 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.035953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.045953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.045953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.055953		NtWriteFile	buffer => X Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.065953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.075953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.075953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.085953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.095953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.105953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.105953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.115953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.125953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.135953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.145953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.145953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.155953		NtWriteFile	buffer => h Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.165953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.175953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.185953		NtWriteFile	buffer => € x Ø €€ €, ˆ @ ¸X˜ phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.185953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.195953		NtWriteFile	buffer => €4hˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.205953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.215953		NtWriteFile	buffer =>  € 4ÀŠ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.215953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.225953		NtWriteFile	buffer => €$D ¶  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.235953		NtWriteFile	buffer => €|# file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.245953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.245953		NtWriteFile	buffer => €(4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.255953		NtWriteFile	buffer => @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.265953		NtWriteFile	buffer => ¨ ,lz  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.275953		NtWriteFile	buffer => €D9€X9€„$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.285953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.285953		NtWriteFile	buffer => ¨ 0t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.295953		NtWriteFile	buffer => Ü# €D9 €X9 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.305953		NtWriteFile	buffer => H file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.315953		NtWriteFile	buffer => ¨ 4„  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.315953		NtWriteFile	buffer => Ü# €D9 €X9 €„$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.325953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.335953		NtWriteFile	buffer =>  8L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.345953		NtWriteFile	buffer => €„$ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.355953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.355953		NtWriteFile	buffer =>  <L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.365953		NtWriteFile	buffer => €$F file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.375953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.385953		NtWriteFile	buffer => €@D è  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.385953		NtWriteFile	buffer => €|# file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.395953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.405953		NtWriteFile	buffer => €D4Ž  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.415953		NtWriteFile	buffer => ` `` ` ` ` `<üÿÿÿ`B````C> file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.425953		NtWriteFile	buffer => ¼ü$T¤D#X#l#X$%øEFh$˜$D%œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.425953		NtWriteFile	buffer => 0H`„À Œ ¨ Ä ì D€Èì8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.435953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.445953		NtWriteFile	buffer => 0 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.455953		NtWriteFile	buffer => € l file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.455953		NtWriteFile	buffer => ¸ Ø `è file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.465953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.475953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.485953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.485953		NtWriteFile	buffer => € 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.495953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.505953		NtWriteFile	buffer => € L file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.515953		NtWriteFile	buffer => h@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.525953		NtWriteFile	buffer => < file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.525953		NtWriteFile	buffer => € t file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.535953		NtWriteFile	buffer => €l €€ ` file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.545953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.555953		NtWriteFile	buffer => € ¤ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.555953		NtWriteFile	buffer => È Ø ˆÀ €Ø €€ ì file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.565953		NtWriteFile	buffer => x file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.576953		NtWriteFile	buffer => € Ü file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.586953		NtWriteFile	buffer => € Ø Ø €€ €, è @ ¸Xø phˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.586953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.596953		NtWriteFile	buffer => €D$ ‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.606953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.616953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.626953		NtWriteFile	buffer => ˆ 4‚‡ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.626953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.636953		NtWriteFile	buffer => €$D$ D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.646953		NtWriteFile	buffer => ˆÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.656953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.666953		NtWriteFile	buffer => ˆ(4 D‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.666953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.676953		NtWriteFile	buffer => €T,L$ ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.686953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.696953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.696953		NtWriteFile	buffer => €0LD ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.706953		NtWriteFile	buffer => ¸ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.716953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.716953		NtWriteFile	buffer => ¸4<ˆ† file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.726953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.736953		NtWriteFile	buffer => €T8D$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.736953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.746953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.756953		NtWriteFile	buffer => €T<4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.766953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.766953		NtWriteFile	buffer => €T@D$ þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.776953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.786953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.786953		NtWriteFile	buffer => €TD4þˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.796953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.806953		NtWriteFile	buffer => €THD$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.806953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.816953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.826953		NtWriteFile	buffer => €TL4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.836953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.836953		NtWriteFile	buffer => €TPD$ 0‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.846953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.856953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.856953		NtWriteFile	buffer => €TT40‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.866953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.876953		NtWriteFile	buffer => €TXD$ &‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.886953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.886953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.896953		NtWriteFile	buffer => €T\4&‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.906953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.906953		NtWriteFile	buffer => €T`D$ ‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.916953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.926953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.936953		NtWriteFile	buffer => €Td4‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.936953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.946953		NtWriteFile	buffer => €hD$ ¢Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.956953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.956953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.966953		NtWriteFile	buffer => €l4¢Š file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.976953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.976953		NtWriteFile	buffer => €pD$ <Œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.986953		NtWriteFile	buffer =>  ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:27.996953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.006953		NtWriteFile	buffer =>  t4<Πfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.006953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.016953		NtWriteFile	buffer => €xD$ nŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.026953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.026953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.036953		NtWriteFile	buffer =>  |4nΠfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.046953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.046953		NtWriteFile	buffer => €€D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.056953		NtWriteFile	buffer => €4" file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.066953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.076953		NtWriteFile	buffer => !€„L! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.076953		NtWriteFile	buffer => 4" file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.086953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.096953		NtWriteFile	buffer => "€ˆD" file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.096953		NtWriteFile	buffer => €¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.106953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.116953		NtWriteFile	buffer => #€ŒL# file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.126953		NtWriteFile	buffer => ¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.136953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.136953		NtWriteFile	buffer => $€D$% àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.146953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.156953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.166953		NtWriteFile	buffer => %€”4$àˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.166953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.176953		NtWriteFile	buffer => &¨ ˜<&º‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.186953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.196953		NtWriteFile	buffer => 'œ<'‹ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.206953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.216953		NtWriteFile	buffer => (€ D$)  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.216953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.226953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.236953		NtWriteFile	buffer => )€¤4( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.246953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.256953		NtWriteFile	buffer => *۬D$+ PΠfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.256953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.266953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.277953		NtWriteFile	buffer => +€¬4*PŒ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.287953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.297953		NtWriteFile	buffer => ,ۡD$- FΠfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.297953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.307953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.317953		NtWriteFile	buffer => -۫4,FΠfile_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.327953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.337953		NtWriteFile	buffer => .€T¸D$/ :‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.347953		NtWriteFile	buffer => €ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.347953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.357953		NtWriteFile	buffer => /€T¼4.:‰ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.367953		NtWriteFile	buffer => ` `` ` ` ` `þÿÿþÿÿÿýÿÿÿýÿÿÿýÿþÿÿþÿÿ   ````þýÿÿþýÿÿ! file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.377953		NtWriteFile	buffer => ¼ü$T¤È%È%¤&¤&ˆ&ttì9ì9Ø9Ø9À9À90:0:::::AAô?ô?AA0AlAŒAÈAt&t&¸BÜ xxPAPA¬A¬A”:”: file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.387953		NtWriteFile	buffer => 0H`„À Œ ´ Ð ø <d€¨Äì0Lt¸Ôü@\„ Èä,Ptœ¸Ôð4\x ¼ä file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.387953		NtWriteFile	buffer => Ð file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.397953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.407953		NtWriteFile	buffer => €\Š„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.417953		NtWriteFile	buffer => €9 X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.417953		NtWriteFile	buffer => ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.427953		NtWriteFile	buffer => €ä ž„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.437953		NtWriteFile	buffer => €9 0D X „+ €”+ €¤+ ´+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.447953		NtWriteFile	buffer => ˆ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.457953		NtWriteFile	buffer => €ä ¨„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.457953		NtWriteFile	buffer => €9 0D X 0, „+ €”+ €¤+ (È+ €Ü+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.467953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.477953		NtWriteFile	buffer => €4¼„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.487953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.487953		NtWriteFile	buffer => €D Ƅ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.497953		NtWriteFile	buffer => €9 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.507953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.517953		NtWriteFile	buffer => €\Є file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.527953		NtWriteFile	buffer => €9 0D file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.527953		NtWriteFile	buffer => | file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.537953		NtWriteFile	buffer => €Ää„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.547953		NtWriteFile	buffer => €9 €`, @t, €Œ, € , €´, €È, 0à, file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.557953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.557953		NtWriteFile	buffer => €\ø„ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.567953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.577953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.587953		NtWriteFile	buffer => € L   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.587953		NtWriteFile	buffer => P8- file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.597953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.607953		NtWriteFile	buffer => €$\   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.607953		NtWriteFile	buffer => P- ۆ+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.617953		NtWriteFile	buffer => ( file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.627953		NtWriteFile	buffer => €(D   file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.637953		NtWriteFile	buffer => €9 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.647953		NtWriteFile	buffer => X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.657953		NtWriteFile	buffer => €,„*  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.657953		NtWriteFile	buffer => €9 €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.667953		NtWriteFile	buffer => X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.677953		NtWriteFile	buffer => €0„4  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.687953		NtWriteFile	buffer => €9 €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.687953		NtWriteFile	buffer => X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.697953		NtWriteFile	buffer => €4„ >  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.707953		NtWriteFile	buffer => €9 €x- €Ü+ €”+ €¤+ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.707953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.717953		NtWriteFile	buffer => €8\H  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.727953		NtWriteFile	buffer => €9 X file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.737953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.737953		NtWriteFile	buffer => €<´R  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.747953		NtWriteFile	buffer => €9 XÔ- Xè- €ü- €. h,. h@. file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.807953		NtWriteFile	buffer => 4 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.817953		NtWriteFile	buffer => €@\p  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.827953		NtWriteFile	buffer => €9 T. file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.837953		NtWriteFile	buffer => ¨ýÿÿ§ýÿÿ ýÿÿ¦ýÿÿ¥ýÿÿ¤ýÿÿ£ýÿÿ¢ýÿÿ¡ýÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.847953		NtWriteFile	buffer => P+h+ð+°=$,8,L,ü,$-L-p"`-Œ-¤-¸-Ü)Œ) file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.857953		NtWriteFile	buffer => 4¼D ` ˆ ¼ 8l”ÈðH ø,œ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.867953		NtWriteFile	buffer => T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.867953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.877953		NtWriteFile	buffer => €4ŒD file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.887953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.897953		NtWriteFile	buffer => €4 Œ< file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.907953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.907953		NtWriteFile	buffer => €4ŒH file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.917953		NtWriteFile	buffer => @ @@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.927953		NtWriteFile	buffer => 8FXF|F file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.937953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.947953		NtWriteFile	buffer => 8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.947953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.957953		NtWriteFile	buffer => €4Œ8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.968953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.978953		NtWriteFile	buffer => €4 ŒD file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.988953		NtWriteFile	buffer => @ @ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.988953		NtWriteFile	buffer =>  FÈF file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:28.998953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.008953		NtWriteFile	buffer => p file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.018953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.018953		NtWriteFile	buffer => €4ŒD file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.028953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.038953		NtWriteFile	buffer => €4 Œ8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.048953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.048953		NtWriteFile	buffer => €4ŒD file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.058953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.068953		NtWriteFile	buffer => €4ŒP file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.078953		NtWriteFile	buffer => @ @@@ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.088953		NtWriteFile	buffer => ðFG4GXG file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.098953		NtWriteFile	buffer => 8T file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.098953		NtWriteFile	buffer => MSFT file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.108953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.118953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.128953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.138953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.138953		NtWriteFile	buffer => Q file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.148953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.158953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.168953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.178953		NtWriteFile	buffer =>  file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.188953		NtWriteFile	buffer => ‘ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.188953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.198953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.208953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.218953		NtWriteFile	buffer => ³ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.218953		NtWriteFile	buffer => # file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.228953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.238953		NtWriteFile	buffer => $ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.248953		NtWriteFile	buffer => ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.258953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.258953		NtWriteFile	buffer => € file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.268953		NtWriteFile	buffer => file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.278953		NtWriteFile	buffer => ¼ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.288953		NtWriteFile	buffer => dÈ,  ô X¼ „èL°xÜ@¤lÐ4˜ü` Ä ( Œ ð T¸€äH ¬ tØ< hÌ0”ø\À$ˆìP´|àD¨pÔ8œdÈ,ôX¼ „èL°xÜ@¤ l Ð 4!˜!ü!`"Ä"(#Œ#ð#T$¸$%€%ä%H&¬&'t'Ø'<( ()h)Ì)0*”*ø*\+À+$,ˆ,ì,P-´-.|.à.D/¨/0p0Ô081œ12d2È2,33ô3X4¼4 5„5è5L6°67x7Ü7@8 file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.298953		NtWriteFile	buffer => ˆ¤8ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.298953		NtWriteFile	buffer => ŒNÐÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.308953		NtWriteFile	buffer => \Wÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.318953		NtWriteFile	buffer => ¼JÐÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.328953		NtWriteFile	buffer => ,<€ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.328953		NtWriteFile	buffer => ¬<ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.338953		NtWriteFile	buffer => xWÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.348953		NtWriteFile	buffer => xYxGÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.358953		NtWriteFile	buffer => ð Tÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.368953		NtWriteFile	buffer => D§ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.368953		NtWriteFile	buffer => ÿÿÿÿÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.378953		NtWriteFile	buffer => Tµÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.388953		NtWriteFile	buffer => ÿÿÿÿÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.398953		NtWriteFile	buffer => ÿÿÿÿÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.398953		NtWriteFile	buffer => ÿÿÿÿÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.408953		NtWriteFile	buffer => &!dµÿÿÿÿÿÿÿÿ€ÿÿÿÿ&! dµ0,ÿÿÿÿÿÿÿÿ€ÿÿÿÿ¦dµHDÿÿÿÿÿÿÿÿ€ÿÿÿÿ#!dµ`@`ÿÿÿÿÿÿÿÿ d ÿÿÿÿ$!”¹xPtÿÿÿÿÿÿÿÿ ÿÿÿÿÿÿÿÿ !˜º„ÿÿÿÿÞ­ÿÿÿÿÿÿÿÿÿÿÿÿ !<»¨œÿÿÿÿþ«ÿÿÿÿÿÿÿÿÿÿÿÿ$!à»ÀP°ÿÿÿÿ~†ÿÿÿÿ 8ÿÿÿÿÿÿÿÿ$!¿ ؐPÌÿÿÿÿø„ÿÿÿÿ $ÿÿÿÿÿÿÿÿ$! XÁ ðPèÿÿÿÿî„ÿÿÿÿ $ÿÿÿÿÿÿÿÿ$! ˜Ã  P ÿÿÿÿä„ÿÿÿÿ $ÿÿÿÿÿÿÿÿ$!ØÅ P ÿÿÿÿR ÿÿÿÿ $ÿÿÿÿÿÿÿÿ$!È 8 P< ÿÿÿÿž„ÿÿÿÿ $ÿÿÿÿÿÿÿÿ%! XÊP X ÿÿÿÿø„ÿÿÿÿ ÿÿÿÿ%!XÊh t ÿÿÿÿî„ÿÿÿÿ ÿÿÿÿ%!XÊ€  ÿÿÿÿä„ÿÿÿÿ  ÿÿÿÿ%!Xʘ ¨ ÿÿÿÿR ÿÿÿÿ 0ÿÿÿÿ%!XÊ° À ÿÿÿÿž„ÿÿÿÿ @ÿÿÿÿ%!XÊÈ Ø ÿÿÿÿÿÿÿÿ Pÿÿÿÿ !XÊà ð ÿÿÿÿö®ÿÿÿÿÿÿÿÿÿÿÿÿ !ÔÊø ÿÿÿÿ¯ÿÿÿÿÿÿÿÿÿÿÿÿ !0Í ÿÿÿÿбÿÿÿÿÿÿÿÿÿÿÿÿ !ÔÍ(8ÿÿÿÿb±ÿÿÿÿÿÿÿÿÿÿÿÿ !Ï@Tÿÿÿÿø¬ÿÿÿÿÿÿÿÿÿÿÿÿ !äÏXhÿÿÿÿF´ÿÿÿÿÿÿÿÿÿÿÿÿ !8Ðp|ÿÿÿÿž¬ÿÿÿÿÿÿÿÿÿÿÿÿ !ŒÐˆ˜ÿÿÿÿt³ÿÿÿÿÿÿÿÿÿÿÿÿ !Ñ °ÿÿÿÿ0¬ÿÿÿÿÿÿÿÿÿÿÿÿ !\ѸÈÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ !ÒÐàÿÿÿÿN¬ÿÿÿÿÿÿÿÿÿÿÿÿ !TÒèøÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ !¨Ò ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ! Ô0ÿÿÿÿ(´ÿÿÿÿÿÿÿÿÿÿÿÿ !!hÔ0Tÿÿÿÿ’®ÿÿÿÿÿÿÿÿÿÿÿÿ !"äÔHpÿÿÿÿÀ²ÿÿÿÿÿÿÿÿÿÿÿÿ !#°Õ`Œÿÿÿÿ„­ÿÿÿÿÿÿÿÿÿÿÿÿ !$,Öx¤ÿÿÿÿ:±ÿÿÿÿÿÿÿÿÿÿÿÿ !%¨ÖÄÿÿÿÿr°ÿÿÿÿÿÿÿÿÿÿÿÿ$!&t×F¨Päÿÿÿÿÿÿÿÿ  ÿÿÿÿÿÿÿÿ$!'ääÀPøÿÿÿÿÿÿÿÿ pÿÿÿÿÿÿÿÿ$!(|êbØPÿÿÿÿÿÿÿÿ ˆ ÿÿÿÿ file_handle => 0x00000390 offset => 0	SUCCESS
2016-11-06 21:48:29.498953		NtCreateFile	create_disposition => 1 file_handle => 0x00000390 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\VBE\MSForms.exd desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VBE\MSForms.exd create_options => 2144 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:48:29.568953		NtOpenFile	file_handle => 0x00000394 filepath => C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Office\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Office\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-06 21:48:29.729953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:29.769953		NtOpenFile	file_handle => 0x00000394 filepath => C:\WINDOWS\system32\MSIMTF.dll desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32\Msimtf.dll open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-06 21:48:29.869953		LdrLoadDll	basename => COMCTL32 module_address => 0x5d090000 flags => 0 module_name => COMCTL32.DLL	SUCCESS
2016-11-06 21:48:29.909953		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\VB12.pip desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\VB12.pip create_options => 4194404 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:48:29.919953		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\VB12.pip desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\VB12.pip create_options => 4194404 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:48:29.929953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:30.129953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:30.329953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:30.530953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:30.550953		LdrLoadDll	basename => mscms module_address => 0x73b30000 flags => 0 module_name => mscms.dll	SUCCESS
2016-11-06 21:48:30.650953		NtCreateFile	create_disposition => 1 file_handle => 0x000003a0 filepath => C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm create_options => 2144 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:48:30.710953		LdrLoadDll	basename => icm32 module_address => 0x66e90000 flags => 0 module_name => icm32.dll	SUCCESS
2016-11-06 21:48:30.730953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:30.930953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:31.131953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:31.191953		NtCreateFile	create_disposition => 1 file_handle => 0x000003a0 filepath => C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6EXT.OLB desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6EXT.OLB create_options => 2144 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:48:31.331953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:31.371953		CoGetClassObject	class_context => 3 clsid => {c62a69f0-16dc-11ce-9e98-00aa00574a4f} iid => {00000001-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:48:31.401953		LdrLoadDll	basename => fm20ENU module_address => 0x70000000 flags => 0 module_name => C:\WINDOWS\system32\fm20ENU.DLL	SUCCESS
2016-11-06 21:48:31.431953		LdrLoadDll	basename => RICHED20 module_address => 0x3a780000 flags => 0 module_name => RICHED20.DLL	SUCCESS
2016-11-06 21:48:31.521953		NtCreateFile	create_disposition => 2 file_handle => 0x000003b0 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Forms desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Forms create_options => 16417 status_info => 2 share_access => 3	SUCCESS
2016-11-06 21:48:31.521953		NtCreateFile	create_disposition => 3 file_handle => 0x000003b0 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Forms\WINWORD.box desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Forms\WINWORD.box create_options => 96 status_info => 2 share_access => 3	SUCCESS
2016-11-06 21:48:31.531953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:31.521953		NtOpenFile	file_handle => 0x000003b0 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Forms\WINWORD.box desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Forms\WINWORD.box open_options => 2113600 status_info => 1 share_access => 7	SUCCESS
2016-11-06 21:48:31.531953		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\Administrator\Application Data\Microsoft\Forms\WINWORD.box desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\Administrator\Application Data\Microsoft\Forms\WINWORD.box create_options => 96 status_info => 4294967295 share_access => 3	FAILURE
2016-11-06 21:48:31.541953		NtCreateFile	create_disposition => 2 file_handle => 0x000003b8 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\~DF99A7.tmp desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF99A7.tmp create_options => 96 status_info => 2 share_access => 1	SUCCESS
2016-11-06 21:48:31.551953		NtCreateFile	create_disposition => 2 file_handle => 0x000003c8 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\~DF99B9.tmp desired_access => 0xc0110080 file_attributes => 256 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF99B9.tmp create_options => 4192 status_info => 2 share_access => 7	SUCCESS
2016-11-06 21:48:31.571953		CoCreateInstance	class_context => 1 clsid => {f748b5f0-15d0-11ce-bf0d-00aa0044bb60} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:48:31.571953		CoCreateInstance	class_context => 1 clsid => {c62a69f0-16dc-11ce-9e98-00aa00574a4f} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:48:31.581953		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\FM20.DLL\2 desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\FM20.DLL\2 create_options => 2144 status_info => 4294967295 share_access => 1	FAILURE
2016-11-06 21:48:31.581953		NtCreateFile	create_disposition => 1 file_handle => 0x000003d4 filepath => C:\WINDOWS\system32\FM20.DLL desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\FM20.DLL create_options => 2144 status_info => 1 share_access => 1	SUCCESS
2016-11-06 21:48:31.611953		CoCreateInstance	class_context => 1 clsid => {46e31370-3f7a-11ce-bed6-00aa00611080} iid => {00000000-0000-0000-c000-000000000046}	SUCCESS
2016-11-06 21:48:31.651953		LdrLoadDll	basename => FM20 module_address => 0x60000000 flags => 2 module_name => C:\WINDOWS\system32\FM20.DLL	SUCCESS
2016-11-06 21:48:31.651953		LdrLoadDll	basename => FM20 module_address => 0x60000000 flags => 2 module_name => C:\WINDOWS\system32\FM20.DLL	SUCCESS
2016-11-06 21:48:31.661953		LdrLoadDll	basename => FM20 module_address => 0x60000000 flags => 2 module_name => C:\WINDOWS\system32\FM20.DLL	SUCCESS
2016-11-06 21:48:31.661953		LdrLoadDll	basename => FM20 module_address => 0x60000000 flags => 2 module_name => C:\WINDOWS\system32\FM20.DLL	SUCCESS
2016-11-06 21:48:31.661953		LdrLoadDll	basename => FM20 module_address => 0x60000000 flags => 2 module_name => C:\WINDOWS\system32\FM20.DLL	SUCCESS
2016-11-06 21:48:31.671953		LdrLoadDll	basename => FM20 module_address => 0x60000000 flags => 2 module_name => C:\WINDOWS\system32\FM20.DLL	SUCCESS
2016-11-06 21:48:31.671953		LdrLoadDll	basename => FM20 module_address => 0x60000000 flags => 2 module_name => C:\WINDOWS\system32\FM20.DLL	SUCCESS
2016-11-06 21:48:31.671953		LdrLoadDll	basename => FM20 module_address => 0x60000000 flags => 2 module_name => C:\WINDOWS\system32\FM20.DLL	SUCCESS
2016-11-06 21:48:31.671953		LdrLoadDll	basename => FM20 module_address => 0x60000000 flags => 2 module_name => C:\WINDOWS\system32\FM20.DLL	SUCCESS
2016-11-06 21:48:31.681953		LdrLoadDll	basename => FM20 module_address => 0x60000000 flags => 2 module_name => C:\WINDOWS\system32\FM20.DLL	SUCCESS
2016-11-06 21:48:31.681953		LdrLoadDll	basename => FM20 module_address => 0x60000000 flags => 2 module_name => C:\WINDOWS\system32\FM20.DLL	SUCCESS
2016-11-06 21:48:31.681953		LdrLoadDll	basename => FM20 module_address => 0x60000000 flags => 2 module_name => C:\WINDOWS\system32\FM20.DLL	SUCCESS
2016-11-06 21:48:31.691953		LdrLoadDll	basename => FM20 module_address => 0x60000000 flags => 2 module_name => C:\WINDOWS\system32\FM20.DLL	SUCCESS
2016-11-06 21:48:31.691953		LdrLoadDll	basename => FM20 module_address => 0x60000000 flags => 2 module_name => C:\WINDOWS\system32\FM20.DLL	SUCCESS
2016-11-06 21:48:31.731953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:31.792953		LdrLoadDll	basename => VBE6 module_address => 0x65000000 flags => 0 module_name => VBE6.DLL	SUCCESS
2016-11-06 21:48:31.932953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:32.012953		LdrLoadDll	basename => VBE6 module_address => 0x65000000 flags => 0 module_name => VBE6.DLL	SUCCESS
2016-11-06 21:48:32.132953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:32.192953		LdrLoadDll	basename => VBE6 module_address => 0x65000000 flags => 0 module_name => VBE6.DLL	SUCCESS
2016-11-06 21:48:32.332953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:32.362953		LdrLoadDll	basename => VBE6 module_address => 0x65000000 flags => 0 module_name => VBE6.DLL	SUCCESS
2016-11-06 21:48:32.473953		LdrLoadDll	basename => VBE6 module_address => 0x65000000 flags => 0 module_name => VBE6.DLL	SUCCESS
2016-11-06 21:48:32.533953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:32.593953		LdrLoadDll	basename => VBE6 module_address => 0x65000000 flags => 0 module_name => VBE6.DLL	SUCCESS
2016-11-06 21:48:32.723953		NtCreateFile	create_disposition => 2 file_handle => 0x000003e8 filepath => C:\Documents and Settings\Administrator\Local Settings\Temp\~DF9B40.tmp desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF9B40.tmp create_options => 96 status_info => 2 share_access => 1	SUCCESS
2016-11-06 21:48:32.733953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:32.753953		LdrLoadDll	basename => VBE6 module_address => 0x65000000 flags => 0 module_name => VBE6.DLL	SUCCESS
2016-11-06 21:48:32.903953		LdrLoadDll	basename => VBE6 module_address => 0x65000000 flags => 0 module_name => VBE6.DLL	SUCCESS
2016-11-06 21:48:32.933953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:33.013953		LdrLoadDll	basename => ntdll module_address => 0x7c900000 flags => 0 module_name => ntdll.dll	SUCCESS
2016-11-06 21:48:33.013953		LdrLoadDll	basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32	SUCCESS
2016-11-06 21:48:33.013953		LdrLoadDll	basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32	SUCCESS
2016-11-06 21:48:33.013953		LdrLoadDll	basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll	SUCCESS
2016-11-06 21:48:33.023953		LdrLoadDll	basename => Psapi module_address => 0x76bf0000 flags => 0 module_name => Psapi.dll	SUCCESS
2016-11-06 21:48:33.023953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4103L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4096L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.033953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 8199L, u'eax': 8L, u'ebp': 1228256L, u'edx': 8192L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.033953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 12295L, u'eax': 8L, u'ebp': 1228256L, u'edx': 12288L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.043953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 16391L, u'eax': 8L, u'ebp': 1228256L, u'edx': 16384L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.043953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 20487L, u'eax': 8L, u'ebp': 1228256L, u'edx': 20480L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.053953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 24583L, u'eax': 8L, u'ebp': 1228256L, u'edx': 24576L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.053953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 28679L, u'eax': 8L, u'ebp': 1228256L, u'edx': 28672L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.053953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 32775L, u'eax': 8L, u'ebp': 1228256L, u'edx': 32768L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.063953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 36871L, u'eax': 8L, u'ebp': 1228256L, u'edx': 36864L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.073953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 40967L, u'eax': 8L, u'ebp': 1228256L, u'edx': 40960L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.083953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 45063L, u'eax': 8L, u'ebp': 1228256L, u'edx': 45056L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.083953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 49159L, u'eax': 8L, u'ebp': 1228256L, u'edx': 49152L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.093953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 53255L, u'eax': 8L, u'ebp': 1228256L, u'edx': 53248L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.103953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 57351L, u'eax': 8L, u'ebp': 1228256L, u'edx': 57344L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.103953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 61447L, u'eax': 8L, u'ebp': 1228256L, u'edx': 61440L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.113953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 69632L, u'eax': 69632L, u'ebp': 1228256L, u'edx': 69625L, u'ebx': 0L, u'esi': 4096L, u'ecx': 69632L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:33.113953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 69639L, u'eax': 8L, u'ebp': 1228256L, u'edx': 69632L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.123953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 73735L, u'eax': 8L, u'ebp': 1228256L, u'edx': 73728L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.133953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:33.133953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 77831L, u'eax': 8L, u'ebp': 1228256L, u'edx': 77824L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.144953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 81927L, u'eax': 8L, u'ebp': 1228256L, u'edx': 81920L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.144953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 86023L, u'eax': 8L, u'ebp': 1228256L, u'edx': 86016L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.154953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 90119L, u'eax': 8L, u'ebp': 1228256L, u'edx': 90112L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.164953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 94215L, u'eax': 8L, u'ebp': 1228256L, u'edx': 94208L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.164953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 98311L, u'eax': 8L, u'ebp': 1228256L, u'edx': 98304L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.174953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 102407L, u'eax': 8L, u'ebp': 1228256L, u'edx': 102400L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.184953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 106503L, u'eax': 8L, u'ebp': 1228256L, u'edx': 106496L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.194953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 110599L, u'eax': 8L, u'ebp': 1228256L, u'edx': 110592L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.194953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 114695L, u'eax': 8L, u'ebp': 1228256L, u'edx': 114688L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.214953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 118791L, u'eax': 8L, u'ebp': 1228256L, u'edx': 118784L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.214953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 122887L, u'eax': 8L, u'ebp': 1228256L, u'edx': 122880L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.224953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 126983L, u'eax': 8L, u'ebp': 1228256L, u'edx': 126976L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.224953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 135168L, u'eax': 135168L, u'ebp': 1228256L, u'edx': 135161L, u'ebx': 0L, u'esi': 4096L, u'ecx': 135168L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:33.234953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 135175L, u'eax': 8L, u'ebp': 1228256L, u'edx': 135168L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.234953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 139271L, u'eax': 8L, u'ebp': 1228256L, u'edx': 139264L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.244953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 143367L, u'eax': 8L, u'ebp': 1228256L, u'edx': 143360L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.244953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 147463L, u'eax': 8L, u'ebp': 1228256L, u'edx': 147456L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.254953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 151559L, u'eax': 8L, u'ebp': 1228256L, u'edx': 151552L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.254953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 155655L, u'eax': 8L, u'ebp': 1228256L, u'edx': 155648L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.264953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 159751L, u'eax': 8L, u'ebp': 1228256L, u'edx': 159744L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.264953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 163847L, u'eax': 8L, u'ebp': 1228256L, u'edx': 163840L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.294953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 167943L, u'eax': 8L, u'ebp': 1228256L, u'edx': 167936L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.294953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 172039L, u'eax': 8L, u'ebp': 1228256L, u'edx': 172032L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.304953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 176135L, u'eax': 8L, u'ebp': 1228256L, u'edx': 176128L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.304953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 180231L, u'eax': 8L, u'ebp': 1228256L, u'edx': 180224L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.314953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 184327L, u'eax': 8L, u'ebp': 1228256L, u'edx': 184320L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.314953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 188423L, u'eax': 8L, u'ebp': 1228256L, u'edx': 188416L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.324953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 192519L, u'eax': 8L, u'ebp': 1228256L, u'edx': 192512L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.324953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 196615L, u'eax': 8L, u'ebp': 1228256L, u'edx': 196608L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.324953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 200711L, u'eax': 8L, u'ebp': 1228256L, u'edx': 200704L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.334953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:33.334953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 204807L, u'eax': 8L, u'ebp': 1228256L, u'edx': 204800L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.334953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 208903L, u'eax': 8L, u'ebp': 1228256L, u'edx': 208896L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.344953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 212999L, u'eax': 8L, u'ebp': 1228256L, u'edx': 212992L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.344953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 217095L, u'eax': 8L, u'ebp': 1228256L, u'edx': 217088L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.374953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 221191L, u'eax': 8L, u'ebp': 1228256L, u'edx': 221184L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.374953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 225287L, u'eax': 8L, u'ebp': 1228256L, u'edx': 225280L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.384953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 229383L, u'eax': 8L, u'ebp': 1228256L, u'edx': 229376L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.384953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 233479L, u'eax': 8L, u'ebp': 1228256L, u'edx': 233472L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.384953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 237575L, u'eax': 8L, u'ebp': 1228256L, u'edx': 237568L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.394953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 241671L, u'eax': 8L, u'ebp': 1228256L, u'edx': 241664L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.394953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 245767L, u'eax': 8L, u'ebp': 1228256L, u'edx': 245760L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.404953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 249863L, u'eax': 8L, u'ebp': 1228256L, u'edx': 249856L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.404953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 253959L, u'eax': 8L, u'ebp': 1228256L, u'edx': 253952L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.414953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 258055L, u'eax': 8L, u'ebp': 1228256L, u'edx': 258048L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.414953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 262151L, u'eax': 8L, u'ebp': 1228256L, u'edx': 262144L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.424953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 266247L, u'eax': 8L, u'ebp': 1228256L, u'edx': 266240L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.424953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 270343L, u'eax': 8L, u'ebp': 1228256L, u'edx': 270336L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.424953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 274439L, u'eax': 8L, u'ebp': 1228256L, u'edx': 274432L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.444953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 278535L, u'eax': 8L, u'ebp': 1228256L, u'edx': 278528L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.444953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 282631L, u'eax': 8L, u'ebp': 1228256L, u'edx': 282624L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.454953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 286727L, u'eax': 8L, u'ebp': 1228256L, u'edx': 286720L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.454953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 290823L, u'eax': 8L, u'ebp': 1228256L, u'edx': 290816L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.464953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 294919L, u'eax': 8L, u'ebp': 1228256L, u'edx': 294912L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.464953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 299015L, u'eax': 8L, u'ebp': 1228256L, u'edx': 299008L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.474953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 303111L, u'eax': 8L, u'ebp': 1228256L, u'edx': 303104L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.474953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 307207L, u'eax': 8L, u'ebp': 1228256L, u'edx': 307200L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.484953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 311303L, u'eax': 8L, u'ebp': 1228256L, u'edx': 311296L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.484953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 315399L, u'eax': 8L, u'ebp': 1228256L, u'edx': 315392L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.484953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 319495L, u'eax': 8L, u'ebp': 1228256L, u'edx': 319488L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.494953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 323591L, u'eax': 8L, u'ebp': 1228256L, u'edx': 323584L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.534953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:33.544953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 327687L, u'eax': 8L, u'ebp': 1228256L, u'edx': 327680L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.544953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 331783L, u'eax': 8L, u'ebp': 1228256L, u'edx': 331776L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.544953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 335879L, u'eax': 8L, u'ebp': 1228256L, u'edx': 335872L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.554953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 339975L, u'eax': 8L, u'ebp': 1228256L, u'edx': 339968L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.554953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 344071L, u'eax': 8L, u'ebp': 1228256L, u'edx': 344064L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.564953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 348167L, u'eax': 8L, u'ebp': 1228256L, u'edx': 348160L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.564953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 352263L, u'eax': 8L, u'ebp': 1228256L, u'edx': 352256L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.574953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 356359L, u'eax': 8L, u'ebp': 1228256L, u'edx': 356352L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.574953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 360455L, u'eax': 8L, u'ebp': 1228256L, u'edx': 360448L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.584953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 364551L, u'eax': 8L, u'ebp': 1228256L, u'edx': 364544L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.584953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 368647L, u'eax': 8L, u'ebp': 1228256L, u'edx': 368640L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.594953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 372743L, u'eax': 8L, u'ebp': 1228256L, u'edx': 372736L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.594953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 376839L, u'eax': 8L, u'ebp': 1228256L, u'edx': 376832L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.594953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 380935L, u'eax': 8L, u'ebp': 1228256L, u'edx': 380928L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.624953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 385031L, u'eax': 8L, u'ebp': 1228256L, u'edx': 385024L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.624953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 389127L, u'eax': 8L, u'ebp': 1228256L, u'edx': 389120L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.634953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 393223L, u'eax': 8L, u'ebp': 1228256L, u'edx': 393216L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.634953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 397319L, u'eax': 8L, u'ebp': 1228256L, u'edx': 397312L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.644953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 401415L, u'eax': 8L, u'ebp': 1228256L, u'edx': 401408L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.644953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 405511L, u'eax': 8L, u'ebp': 1228256L, u'edx': 405504L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.654953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 409607L, u'eax': 8L, u'ebp': 1228256L, u'edx': 409600L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.654953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 413703L, u'eax': 8L, u'ebp': 1228256L, u'edx': 413696L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.664953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 417799L, u'eax': 8L, u'ebp': 1228256L, u'edx': 417792L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.664953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 421895L, u'eax': 8L, u'ebp': 1228256L, u'edx': 421888L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.674953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 425991L, u'eax': 8L, u'ebp': 1228256L, u'edx': 425984L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.674953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 430087L, u'eax': 8L, u'ebp': 1228256L, u'edx': 430080L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.674953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 434183L, u'eax': 8L, u'ebp': 1228256L, u'edx': 434176L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.704953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 438279L, u'eax': 8L, u'ebp': 1228256L, u'edx': 438272L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.714953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 442375L, u'eax': 8L, u'ebp': 1228256L, u'edx': 442368L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.714953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 446471L, u'eax': 8L, u'ebp': 1228256L, u'edx': 446464L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.714953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 450567L, u'eax': 8L, u'ebp': 1228256L, u'edx': 450560L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.724953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 454663L, u'eax': 8L, u'ebp': 1228256L, u'edx': 454656L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.724953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 458759L, u'eax': 8L, u'ebp': 1228256L, u'edx': 458752L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.734953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:33.734953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 462855L, u'eax': 8L, u'ebp': 1228256L, u'edx': 462848L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.734953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 466951L, u'eax': 8L, u'ebp': 1228256L, u'edx': 466944L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.744953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 471047L, u'eax': 8L, u'ebp': 1228256L, u'edx': 471040L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.744953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 475143L, u'eax': 8L, u'ebp': 1228256L, u'edx': 475136L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.754953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 479239L, u'eax': 8L, u'ebp': 1228256L, u'edx': 479232L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.754953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 483335L, u'eax': 8L, u'ebp': 1228256L, u'edx': 483328L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.774953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 487431L, u'eax': 8L, u'ebp': 1228256L, u'edx': 487424L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.784953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 491527L, u'eax': 8L, u'ebp': 1228256L, u'edx': 491520L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.784953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 495623L, u'eax': 8L, u'ebp': 1228256L, u'edx': 495616L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.784953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 499719L, u'eax': 8L, u'ebp': 1228256L, u'edx': 499712L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.794953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 503815L, u'eax': 8L, u'ebp': 1228256L, u'edx': 503808L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.794953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 507911L, u'eax': 8L, u'ebp': 1228256L, u'edx': 507904L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.804953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 512007L, u'eax': 8L, u'ebp': 1228256L, u'edx': 512000L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.804953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 516103L, u'eax': 8L, u'ebp': 1228256L, u'edx': 516096L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.814953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 520199L, u'eax': 8L, u'ebp': 1228256L, u'edx': 520192L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.814953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 524295L, u'eax': 8L, u'ebp': 1228256L, u'edx': 524288L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.824953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 528391L, u'eax': 8L, u'ebp': 1228256L, u'edx': 528384L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.824953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 532487L, u'eax': 8L, u'ebp': 1228256L, u'edx': 532480L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.855953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 536583L, u'eax': 8L, u'ebp': 1228256L, u'edx': 536576L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.865953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 540679L, u'eax': 8L, u'ebp': 1228256L, u'edx': 540672L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.865953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 544775L, u'eax': 8L, u'ebp': 1228256L, u'edx': 544768L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.875953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 548871L, u'eax': 8L, u'ebp': 1228256L, u'edx': 548864L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.885953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 552967L, u'eax': 8L, u'ebp': 1228256L, u'edx': 552960L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.885953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 557063L, u'eax': 8L, u'ebp': 1228256L, u'edx': 557056L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.885953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 561159L, u'eax': 8L, u'ebp': 1228256L, u'edx': 561152L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.895953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 565255L, u'eax': 8L, u'ebp': 1228256L, u'edx': 565248L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.895953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 569351L, u'eax': 8L, u'ebp': 1228256L, u'edx': 569344L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.905953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 573447L, u'eax': 8L, u'ebp': 1228256L, u'edx': 573440L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.905953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 577543L, u'eax': 8L, u'ebp': 1228256L, u'edx': 577536L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.955953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 581639L, u'eax': 8L, u'ebp': 1228256L, u'edx': 581632L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.955953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 585735L, u'eax': 8L, u'ebp': 1228256L, u'edx': 585728L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.965953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 589831L, u'eax': 8L, u'ebp': 1228256L, u'edx': 589824L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.975953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 593927L, u'eax': 8L, u'ebp': 1228256L, u'edx': 593920L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.975953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 598023L, u'eax': 8L, u'ebp': 1228256L, u'edx': 598016L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.985953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 602119L, u'eax': 8L, u'ebp': 1228256L, u'edx': 602112L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.995953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 606215L, u'eax': 8L, u'ebp': 1228256L, u'edx': 606208L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:33.995953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 610311L, u'eax': 8L, u'ebp': 1228256L, u'edx': 610304L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.005953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 614407L, u'eax': 8L, u'ebp': 1228256L, u'edx': 614400L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.015953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 618503L, u'eax': 8L, u'ebp': 1228256L, u'edx': 618496L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.015953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 622599L, u'eax': 8L, u'ebp': 1228256L, u'edx': 622592L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.025953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:34.025953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 626695L, u'eax': 8L, u'ebp': 1228256L, u'edx': 626688L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.035953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 630791L, u'eax': 8L, u'ebp': 1228256L, u'edx': 630784L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.045953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 634887L, u'eax': 8L, u'ebp': 1228256L, u'edx': 634880L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.045953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 638983L, u'eax': 8L, u'ebp': 1228256L, u'edx': 638976L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.055953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 643079L, u'eax': 8L, u'ebp': 1228256L, u'edx': 643072L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.065953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 647175L, u'eax': 8L, u'ebp': 1228256L, u'edx': 647168L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.075953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 651271L, u'eax': 8L, u'ebp': 1228256L, u'edx': 651264L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.075953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 655367L, u'eax': 8L, u'ebp': 1228256L, u'edx': 655360L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.085953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 659463L, u'eax': 8L, u'ebp': 1228256L, u'edx': 659456L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.095953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 663559L, u'eax': 8L, u'ebp': 1228256L, u'edx': 663552L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.095953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 667655L, u'eax': 8L, u'ebp': 1228256L, u'edx': 667648L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.105953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 671751L, u'eax': 8L, u'ebp': 1228256L, u'edx': 671744L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.115953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 675847L, u'eax': 8L, u'ebp': 1228256L, u'edx': 675840L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.115953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 679943L, u'eax': 8L, u'ebp': 1228256L, u'edx': 679936L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.125953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 684039L, u'eax': 8L, u'ebp': 1228256L, u'edx': 684032L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.135953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 688135L, u'eax': 8L, u'ebp': 1228256L, u'edx': 688128L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.135953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 692231L, u'eax': 8L, u'ebp': 1228256L, u'edx': 692224L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.145953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 696327L, u'eax': 8L, u'ebp': 1228256L, u'edx': 696320L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.155953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 700423L, u'eax': 8L, u'ebp': 1228256L, u'edx': 700416L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.165953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 704519L, u'eax': 8L, u'ebp': 1228256L, u'edx': 704512L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.175953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 708615L, u'eax': 8L, u'ebp': 1228256L, u'edx': 708608L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.175953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 712711L, u'eax': 8L, u'ebp': 1228256L, u'edx': 712704L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.185953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 716807L, u'eax': 8L, u'ebp': 1228256L, u'edx': 716800L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.195953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 720903L, u'eax': 8L, u'ebp': 1228256L, u'edx': 720896L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.195953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 724999L, u'eax': 8L, u'ebp': 1228256L, u'edx': 724992L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.205953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 729095L, u'eax': 8L, u'ebp': 1228256L, u'edx': 729088L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.215953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 733191L, u'eax': 8L, u'ebp': 1228256L, u'edx': 733184L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.215953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 737287L, u'eax': 8L, u'ebp': 1228256L, u'edx': 737280L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.225953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:34.225953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 741383L, u'eax': 8L, u'ebp': 1228256L, u'edx': 741376L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.235953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 745479L, u'eax': 8L, u'ebp': 1228256L, u'edx': 745472L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.245953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 749575L, u'eax': 8L, u'ebp': 1228256L, u'edx': 749568L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.245953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 753671L, u'eax': 8L, u'ebp': 1228256L, u'edx': 753664L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.255953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 757767L, u'eax': 8L, u'ebp': 1228256L, u'edx': 757760L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.255953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 761863L, u'eax': 8L, u'ebp': 1228256L, u'edx': 761856L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.265953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 765959L, u'eax': 8L, u'ebp': 1228256L, u'edx': 765952L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.275953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 770055L, u'eax': 8L, u'ebp': 1228256L, u'edx': 770048L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.275953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 774151L, u'eax': 8L, u'ebp': 1228256L, u'edx': 774144L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.285953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 778247L, u'eax': 8L, u'ebp': 1228256L, u'edx': 778240L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.295953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 782343L, u'eax': 8L, u'ebp': 1228256L, u'edx': 782336L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.305953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 786439L, u'eax': 8L, u'ebp': 1228256L, u'edx': 786432L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.305953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 790535L, u'eax': 8L, u'ebp': 1228256L, u'edx': 790528L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.315953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 794631L, u'eax': 8L, u'ebp': 1228256L, u'edx': 794624L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.325953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 798727L, u'eax': 8L, u'ebp': 1228256L, u'edx': 798720L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.335953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 802823L, u'eax': 8L, u'ebp': 1228256L, u'edx': 802816L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.345953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 806919L, u'eax': 8L, u'ebp': 1228256L, u'edx': 806912L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.345953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 811015L, u'eax': 8L, u'ebp': 1228256L, u'edx': 811008L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.355953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 815111L, u'eax': 8L, u'ebp': 1228256L, u'edx': 815104L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.365953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 819207L, u'eax': 8L, u'ebp': 1228256L, u'edx': 819200L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.375953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 823303L, u'eax': 8L, u'ebp': 1228256L, u'edx': 823296L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.375953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 827399L, u'eax': 8L, u'ebp': 1228256L, u'edx': 827392L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.385953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 831495L, u'eax': 8L, u'ebp': 1228256L, u'edx': 831488L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.395953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 835591L, u'eax': 8L, u'ebp': 1228256L, u'edx': 835584L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.405953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 839687L, u'eax': 8L, u'ebp': 1228256L, u'edx': 839680L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.405953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 843783L, u'eax': 8L, u'ebp': 1228256L, u'edx': 843776L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.415953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 847879L, u'eax': 8L, u'ebp': 1228256L, u'edx': 847872L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.425953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:34.425953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 851975L, u'eax': 8L, u'ebp': 1228256L, u'edx': 851968L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.435953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 856071L, u'eax': 8L, u'ebp': 1228256L, u'edx': 856064L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.435953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 860167L, u'eax': 8L, u'ebp': 1228256L, u'edx': 860160L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.445953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 864263L, u'eax': 8L, u'ebp': 1228256L, u'edx': 864256L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.455953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 868359L, u'eax': 8L, u'ebp': 1228256L, u'edx': 868352L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.465953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 872455L, u'eax': 8L, u'ebp': 1228256L, u'edx': 872448L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.465953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 876551L, u'eax': 8L, u'ebp': 1228256L, u'edx': 876544L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.475953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 880647L, u'eax': 8L, u'ebp': 1228256L, u'edx': 880640L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.485953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 884743L, u'eax': 8L, u'ebp': 1228256L, u'edx': 884736L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.485953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 888839L, u'eax': 8L, u'ebp': 1228256L, u'edx': 888832L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.495953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 892935L, u'eax': 8L, u'ebp': 1228256L, u'edx': 892928L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.505953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 897031L, u'eax': 8L, u'ebp': 1228256L, u'edx': 897024L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.515953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 901127L, u'eax': 8L, u'ebp': 1228256L, u'edx': 901120L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.515953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 905223L, u'eax': 8L, u'ebp': 1228256L, u'edx': 905216L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.525953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 909319L, u'eax': 8L, u'ebp': 1228256L, u'edx': 909312L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.536953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 913415L, u'eax': 8L, u'ebp': 1228256L, u'edx': 913408L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.546953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 917511L, u'eax': 8L, u'ebp': 1228256L, u'edx': 917504L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.546953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 921607L, u'eax': 8L, u'ebp': 1228256L, u'edx': 921600L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.556953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 925703L, u'eax': 8L, u'ebp': 1228256L, u'edx': 925696L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.566953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 929799L, u'eax': 8L, u'ebp': 1228256L, u'edx': 929792L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.576953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 933895L, u'eax': 8L, u'ebp': 1228256L, u'edx': 933888L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.576953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 937991L, u'eax': 8L, u'ebp': 1228256L, u'edx': 937984L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.646953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:34.646953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 942087L, u'eax': 8L, u'ebp': 1228256L, u'edx': 942080L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.656953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 946183L, u'eax': 8L, u'ebp': 1228256L, u'edx': 946176L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.666953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 950279L, u'eax': 8L, u'ebp': 1228256L, u'edx': 950272L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.676953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 954375L, u'eax': 8L, u'ebp': 1228256L, u'edx': 954368L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.686953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 958471L, u'eax': 8L, u'ebp': 1228256L, u'edx': 958464L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.686953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 962567L, u'eax': 8L, u'ebp': 1228256L, u'edx': 962560L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.726953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 966663L, u'eax': 8L, u'ebp': 1228256L, u'edx': 966656L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.736953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 970759L, u'eax': 8L, u'ebp': 1228256L, u'edx': 970752L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.746953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 974855L, u'eax': 8L, u'ebp': 1228256L, u'edx': 974848L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.756953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 978951L, u'eax': 8L, u'ebp': 1228256L, u'edx': 978944L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.756953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 983047L, u'eax': 8L, u'ebp': 1228256L, u'edx': 983040L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.776953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 987143L, u'eax': 8L, u'ebp': 1228256L, u'edx': 987136L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.776953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 991239L, u'eax': 8L, u'ebp': 1228256L, u'edx': 991232L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.786953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 995335L, u'eax': 8L, u'ebp': 1228256L, u'edx': 995328L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.806953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 999431L, u'eax': 8L, u'ebp': 1228256L, u'edx': 999424L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.816953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1003527L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1003520L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.816953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1007623L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1007616L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.826953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1011719L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1011712L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.836953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1015815L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1015808L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.846953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:34.846953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1019911L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1019904L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.856953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1024007L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1024000L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.866953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1028103L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1028096L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.876953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1032199L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1032192L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.886953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1036295L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1036288L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.896953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1040391L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1040384L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.896953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1044487L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1044480L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.906953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1048583L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1048576L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.916953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1052679L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1052672L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.926953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1056775L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1056768L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.926953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1060871L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1060864L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.936953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1064967L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1064960L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.946953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1069063L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1069056L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.946953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1073159L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1073152L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.956953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1077255L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1077248L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.966953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1081351L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1081344L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.966953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1085447L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1085440L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.976953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1089543L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1089536L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.986953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1093639L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1093632L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.986953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1097735L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1097728L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:34.996953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1101831L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1101824L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.026953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1105927L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1105920L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.026953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1110023L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1110016L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.036953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1114119L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1114112L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.046953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:35.046953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1118215L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1118208L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.056953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1122311L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1122304L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.056953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1126407L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1126400L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.066953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1130503L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1130496L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.076953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1257472L, u'eax': 1257472L, u'ebp': 1228256L, u'edx': 1257465L, u'ebx': 0L, u'esi': 4096L, u'ecx': 1257472L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:35.076953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1257479L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1257472L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.086953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1261575L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1261568L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.086953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1265671L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1265664L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.116953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1269767L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1269760L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.116953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1273863L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1273856L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.126953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1277959L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1277952L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.126953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1282055L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1282048L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.136953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1286151L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1286144L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.136953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1290247L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1290240L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.146953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1294343L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1294336L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.156953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1298439L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1298432L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.156953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1302535L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1302528L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.166953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1306631L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1306624L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.166953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1314816L, u'eax': 1314816L, u'ebp': 1228256L, u'edx': 1314809L, u'ebx': 0L, u'esi': 4096L, u'ecx': 1314816L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:35.206953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1314823L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1314816L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.206953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1318919L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1318912L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.216953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1323015L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1323008L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.227953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1327111L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1327104L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.227953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1331207L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1331200L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.237953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1335303L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1335296L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.237953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1339399L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1339392L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.247953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:35.247953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1343495L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1343488L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.247953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1347591L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1347584L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.257953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1351687L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1351680L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.257953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1355783L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1355776L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.297953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1359879L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1359872L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.297953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1363975L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1363968L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.307953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1368071L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1368064L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.307953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1372167L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1372160L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.317953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1380352L, u'eax': 1380352L, u'ebp': 1228256L, u'edx': 1380345L, u'ebx': 0L, u'esi': 4096L, u'ecx': 1380352L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:35.327953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1380359L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1380352L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.327953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1384455L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1384448L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.337953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1388551L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1388544L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.337953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1392647L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1392640L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.347953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1396743L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1396736L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.347953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1400839L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1400832L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.407953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1404935L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1404928L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.407953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1409031L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1409024L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.417953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1413127L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1413120L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.417953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1417223L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1417216L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.427953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1421319L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1421312L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.437953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1425415L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1425408L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.437953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1429511L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1429504L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.487953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:35.487953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1433607L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1433600L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.487953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1437703L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1437696L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.497953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1445888L, u'eax': 1445888L, u'ebp': 1228256L, u'edx': 1445881L, u'ebx': 0L, u'esi': 4096L, u'ecx': 1445888L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:35.527953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1445895L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1445888L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.527953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1449991L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1449984L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.537953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1454087L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1454080L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.537953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1458183L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1458176L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.537953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1462279L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1462272L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.567953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1466375L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1466368L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.577953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1470471L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1470464L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.577953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1474567L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1474560L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.587953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1478663L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1478656L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.587953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1482759L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1482752L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.637953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1486855L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1486848L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.647953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1490951L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1490944L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.647953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1495047L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1495040L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.677953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1499143L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1499136L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.677953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1503239L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1503232L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.687953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:35.687953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1511424L, u'eax': 1511424L, u'ebp': 1228256L, u'edx': 1511417L, u'ebx': 0L, u'esi': 4096L, u'ecx': 1511424L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:35.687953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1511431L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1511424L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.707953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1515527L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1515520L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.717953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1519623L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1519616L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.727953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1523719L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1523712L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.737953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1527815L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1527808L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.737953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1531911L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1531904L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.757953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1536007L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1536000L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.757953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1540103L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1540096L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.767953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1544199L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1544192L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.777953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1548295L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1548288L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.777953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1552391L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1552384L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.787953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1556487L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1556480L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.787953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1560583L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1560576L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.797953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1564679L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1564672L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.797953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 1568775L, u'eax': 8L, u'ebp': 1228256L, u'edx': 1568768L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.847953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2269184L, u'eax': 2269184L, u'ebp': 1228256L, u'edx': 2269177L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2269184L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:35.847953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2269191L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2269184L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.857953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2273287L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2273280L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.867953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2318336L, u'eax': 2318336L, u'ebp': 1228256L, u'edx': 2318329L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2318336L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:35.877953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2318343L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2318336L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.877953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2322439L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2322432L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.887953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:35.897953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2412544L, u'eax': 2412544L, u'ebp': 1228256L, u'edx': 2412537L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2412544L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:35.897953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2412551L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2412544L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.907953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2416647L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2416640L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.917953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2428928L, u'eax': 2428928L, u'ebp': 1228256L, u'edx': 2428921L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2428928L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:35.917953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2428935L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2428928L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.928953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2433031L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2433024L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.938953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2469888L, u'eax': 2469888L, u'ebp': 1228256L, u'edx': 2469881L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2469888L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:35.938953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2469895L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2469888L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.948953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2473991L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2473984L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.958953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2560000L, u'eax': 2560000L, u'ebp': 1228256L, u'edx': 2559993L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2560000L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:35.968953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2560007L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2560000L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.968953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2564103L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2564096L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.978953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2568199L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2568192L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.978953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2572295L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2572288L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.988953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2576391L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2576384L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.998953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2580487L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2580480L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:35.998953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2584583L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2584576L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.008953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2588679L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2588672L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.018953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2592775L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2592768L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.018953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2596871L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2596864L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.028953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2600967L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2600960L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.038953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2605063L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2605056L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.038953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2609159L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2609152L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.048953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2613255L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2613248L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.058953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2617351L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2617344L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.058953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2646016L, u'eax': 2646016L, u'ebp': 1228256L, u'edx': 2646009L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2646016L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:36.068953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2646023L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2646016L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.078953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2650119L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2650112L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.078953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2654215L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2654208L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.088953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:36.088953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2658311L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2658304L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.098953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2662407L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2662400L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.098953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2666503L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2666496L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.108953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2670599L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2670592L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.118953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2674695L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2674688L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.128953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2678791L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2678784L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.128953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2682887L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2682880L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.138953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2699264L, u'eax': 2699264L, u'ebp': 1228256L, u'edx': 2699257L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2699264L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:36.148953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2699271L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2699264L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.148953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2703367L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2703360L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.158953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2707463L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2707456L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.168953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2711559L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2711552L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.178953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2715655L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2715648L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.178953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2719751L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2719744L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.188953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2723847L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2723840L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.188953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2727943L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2727936L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.198953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2732039L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2732032L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.208953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2736135L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2736128L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.218953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2740231L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2740224L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.228953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2744327L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2744320L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.238953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2748423L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2748416L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.278953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2842624L, u'eax': 2842624L, u'ebp': 1228256L, u'edx': 2842617L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2842624L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:36.288953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:36.288953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2842631L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2842624L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.298953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2846727L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2846720L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.298953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2850823L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2850816L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.308953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2854919L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2854912L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.318953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2859015L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2859008L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.318953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2863111L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2863104L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.328953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2867207L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2867200L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.338953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2871303L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2871296L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.338953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2875399L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2875392L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.348953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 2879495L, u'eax': 8L, u'ebp': 1228256L, u'edx': 2879488L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.378953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3149824L, u'eax': 3149824L, u'ebp': 1228256L, u'edx': 3149817L, u'ebx': 0L, u'esi': 4096L, u'ecx': 3149824L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:36.378953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3149831L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3149824L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.388953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3153927L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3153920L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.398953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3158023L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3158016L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.398953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3162119L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3162112L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.408953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3166215L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3166208L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.418953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3170311L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3170304L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.418953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3174407L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3174400L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.428953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3178503L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3178496L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.438953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3182599L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3182592L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.438953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3186695L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3186688L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.448953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3190791L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3190784L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.458953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3194887L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3194880L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.458953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3198983L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3198976L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.468953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3203079L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3203072L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.468953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3207175L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3207168L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.488953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:36.518953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3477504L, u'eax': 3477504L, u'ebp': 1228256L, u'edx': 3477497L, u'ebx': 0L, u'esi': 4096L, u'ecx': 3477504L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:36.528953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3477511L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3477504L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.528953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3481607L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3481600L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.538953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3485703L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3485696L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.548953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3489799L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3489792L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.548953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3493895L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3493888L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.558953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3497991L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3497984L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.568953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3502087L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3502080L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.568953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3506183L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3506176L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.578953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3510279L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3510272L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.588953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3514375L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3514368L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.588953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3518471L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3518464L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.598953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3522567L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3522560L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.608953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3526663L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3526656L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.608953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3530759L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3530752L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.619953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3534855L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3534848L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.629953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3563520L, u'eax': 3563520L, u'ebp': 1228256L, u'edx': 3563513L, u'ebx': 0L, u'esi': 4096L, u'ecx': 3563520L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:36.629953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3563527L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3563520L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.639953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3567623L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3567616L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.649953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3571719L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3571712L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.649953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3575815L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3575808L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.659953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3579911L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3579904L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.669953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3584007L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3584000L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.669953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3588103L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3588096L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.679953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3592199L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3592192L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.679953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3596295L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3596288L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.689953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:36.689953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3600391L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3600384L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.699953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3661824L, u'eax': 3661824L, u'ebp': 1228256L, u'edx': 3661817L, u'ebx': 0L, u'esi': 4096L, u'ecx': 3661824L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:36.709953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3661831L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3661824L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.709953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3665927L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3665920L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.719953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3682304L, u'eax': 3682304L, u'ebp': 1228256L, u'edx': 3682297L, u'ebx': 0L, u'esi': 4096L, u'ecx': 3682304L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:36.729953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3682311L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3682304L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.739953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3686407L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3686400L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.739953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3690503L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3690496L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.749953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3694599L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3694592L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.759953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3698695L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3698688L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.759953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3702791L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3702784L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.769953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3706887L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3706880L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.779953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3710983L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3710976L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.779953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3715079L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3715072L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.789953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3719175L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3719168L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.799953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3723271L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3723264L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.809953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3727367L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3727360L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.809953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3731463L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3731456L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.819953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3756032L, u'eax': 3756032L, u'ebp': 1228256L, u'edx': 3756025L, u'ebx': 0L, u'esi': 4096L, u'ecx': 3756032L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:36.829953		NtDelayExecution	skipped => 0 milliseconds => 60000	SUCCESS
2016-11-06 21:48:36.829953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3756039L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3756032L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.839953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3760135L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3760128L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.849953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3764231L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3764224L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.849953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3768327L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3768320L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.879953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3772423L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3772416L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.889953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3776519L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3776512L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.889953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3780615L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3780608L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.919953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:36.919953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3784711L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3784704L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.919953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3788807L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3788800L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.929953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3792903L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3792896L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.929953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3796999L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3796992L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.959953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3805184L, u'eax': 3805184L, u'ebp': 1228256L, u'edx': 3805177L, u'ebx': 0L, u'esi': 4096L, u'ecx': 3805184L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:36.959953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3805191L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3805184L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.969953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3809287L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3809280L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.969953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3813383L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3813376L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.999953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3817479L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3817472L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:36.999953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3821575L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3821568L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.009953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3825671L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3825664L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.009953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3829767L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3829760L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.009953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3833863L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3833856L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.049953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3837959L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3837952L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.059953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3842055L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3842048L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.059953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3846151L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3846144L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.089953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3850247L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3850240L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.099953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3854343L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3854336L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.099953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3858439L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3858432L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.119953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:37.119953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3862535L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3862528L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.129953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3870720L, u'eax': 3870720L, u'ebp': 1228256L, u'edx': 3870713L, u'ebx': 0L, u'esi': 4096L, u'ecx': 3870720L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:37.179953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3870727L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3870720L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.179953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3874823L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3874816L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.189953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3878919L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3878912L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.189953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3883015L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3883008L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.219953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3887111L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3887104L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.219953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3891207L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3891200L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.229953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3895303L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3895296L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.259953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3899399L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3899392L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.259953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3903495L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3903488L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.269953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3907591L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3907584L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.269953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3911687L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3911680L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.299953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3915783L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3915776L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.299953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3919879L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3919872L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.309953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3923975L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3923968L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.309953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3928071L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3928064L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.350953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:37.350953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3936256L, u'eax': 3936256L, u'ebp': 1228256L, u'edx': 3936249L, u'ebx': 0L, u'esi': 4096L, u'ecx': 3936256L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:37.360953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3936263L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3936256L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.390953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3940359L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3940352L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.390953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3944455L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3944448L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.400953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3948551L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3948544L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.400953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3952647L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3952640L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.440953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3956743L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3956736L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.450953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3960839L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3960832L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.460953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3964935L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3964928L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.460953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3969031L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3969024L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.520953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3973127L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3973120L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.550953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:37.560953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3977223L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3977216L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.560953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3981319L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3981312L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.590953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3985415L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3985408L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.600953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3989511L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3989504L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.630953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 3993607L, u'eax': 8L, u'ebp': 1228256L, u'edx': 3993600L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.640953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4001792L, u'eax': 4001792L, u'ebp': 1228256L, u'edx': 4001785L, u'ebx': 0L, u'esi': 4096L, u'ecx': 4001792L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:37.670953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4001799L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4001792L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.670953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4005895L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4005888L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.680953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4009991L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4009984L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.710953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4014087L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4014080L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.710953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4018183L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4018176L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.720953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4022279L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4022272L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.750953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:37.750953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4026375L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4026368L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.760953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4030471L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4030464L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.770953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4034567L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4034560L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.770953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4038663L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4038656L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.800953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4042759L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4042752L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.810953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4046855L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4046848L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.810953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4050951L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4050944L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.840953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4055047L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4055040L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.850953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4059143L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4059136L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.880953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4067328L, u'eax': 4067328L, u'ebp': 1228256L, u'edx': 4067321L, u'ebx': 0L, u'esi': 4096L, u'ecx': 4067328L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:37.890953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4067335L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4067328L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.950953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:37.960953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4071431L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4071424L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.960953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4075527L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4075520L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.970953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4079623L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4079616L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:37.970953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4083719L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4083712L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.000953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4087815L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4087808L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.011953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4091911L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4091904L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.041953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4096007L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4096000L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.051953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4100103L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4100096L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.051953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4104199L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4104192L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.061953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4108295L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4108288L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.091953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4112391L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4112384L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.091953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4116487L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4116480L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.101953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4120583L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4120576L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.111953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4124679L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4124672L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.121953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4136960L, u'eax': 4136960L, u'ebp': 1228256L, u'edx': 4136953L, u'ebx': 0L, u'esi': 4096L, u'ecx': 4136960L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:38.131953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4136967L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4136960L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.131953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4141063L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4141056L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.141953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4145159L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4145152L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.151953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:38.161953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4149255L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4149248L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.161953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4153351L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4153344L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.181953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4157447L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4157440L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.181953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4161543L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4161536L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.191953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4165639L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4165632L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.201953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4169735L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4169728L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.211953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4173831L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4173824L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.221953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4177927L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4177920L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.231953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4182023L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4182016L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.241953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4186119L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4186112L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.251953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4190215L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4190208L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.271953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4202496L, u'eax': 4202496L, u'ebp': 1228256L, u'edx': 4202489L, u'ebx': 0L, u'esi': 4096L, u'ecx': 4202496L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:38.281953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4202503L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4202496L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.281953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4206599L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4206592L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.291953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4210695L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4210688L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.321953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4214791L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4214784L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.321953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4218887L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4218880L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.331953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4222983L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4222976L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.341953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4227079L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4227072L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.351953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:38.351953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4231175L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4231168L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.361953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4235271L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4235264L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.361953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4239367L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4239360L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.371953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4243463L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4243456L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.381953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4247559L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4247552L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.391953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4251655L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4251648L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.401953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4255751L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4255744L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.411953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4333568L, u'eax': 4333568L, u'ebp': 1228256L, u'edx': 4333561L, u'ebx': 0L, u'esi': 4096L, u'ecx': 4333568L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:38.421953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4333575L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4333568L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.431953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4337671L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4337664L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.431953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4341767L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4341760L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.441953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4345863L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4345856L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.451953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4349959L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4349952L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.461953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4354055L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4354048L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.471953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4358151L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4358144L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.471953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4362247L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4362240L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.481953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4366343L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4366336L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.491953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4370439L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4370432L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.501953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4374535L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4374528L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.511953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4378631L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4378624L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.511953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4382727L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4382720L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.521953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4386823L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4386816L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.531953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4395008L, u'eax': 4395008L, u'ebp': 1228256L, u'edx': 4395001L, u'ebx': 0L, u'esi': 4096L, u'ecx': 4395008L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:38.541953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4395015L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4395008L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.551953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:38.551953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4399111L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4399104L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.561953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4403207L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4403200L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.561953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4407303L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4407296L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.571953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4411399L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4411392L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.581953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4415495L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4415488L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.591953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4419591L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4419584L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.601953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4423687L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4423680L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.601953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4427783L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4427776L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.611953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4431879L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4431872L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.621953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4435975L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4435968L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.631953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4440071L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4440064L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.641953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4444167L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4444160L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.651953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4448263L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4448256L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.651953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4452359L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4452352L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.661953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4460544L, u'eax': 4460544L, u'ebp': 1228256L, u'edx': 4460537L, u'ebx': 0L, u'esi': 4096L, u'ecx': 4460544L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:38.671953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4460551L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4460544L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.681953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4464647L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4464640L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.691953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4468743L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4468736L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.702953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4472839L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4472832L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.702953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4476935L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4476928L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.712953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4481031L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4481024L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.722953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4485127L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4485120L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.732953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4489223L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4489216L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.742953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4493319L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4493312L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.742953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4497415L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4497408L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.752953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:38.762953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4501511L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4501504L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.762953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4505607L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4505600L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.772953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4509703L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4509696L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.782953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4513799L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4513792L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.792953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4517895L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4517888L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.802953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4591616L, u'eax': 4591616L, u'ebp': 1228256L, u'edx': 4591609L, u'ebx': 0L, u'esi': 4096L, u'ecx': 4591616L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:38.812953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4591623L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4591616L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.822953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4595719L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4595712L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.832953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4599815L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4599808L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.842953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4603911L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4603904L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.842953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4608007L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4608000L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.852953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4612103L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4612096L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.862953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4616199L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4616192L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.872953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4620295L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4620288L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.882953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4624391L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4624384L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.892953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4628487L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4628480L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.892953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4632583L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4632576L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.902953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4636679L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4636672L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.912953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4640775L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4640768L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.922953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4644871L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4644864L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.932953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4648967L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4648960L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.942953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4857856L, u'eax': 4857856L, u'ebp': 1228256L, u'edx': 4857849L, u'ebx': 0L, u'esi': 4096L, u'ecx': 4857856L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:38.952953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4857863L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4857856L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.962953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:38.962953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4861959L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4861952L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.972953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4866055L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4866048L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.982953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4870151L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4870144L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.992953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4874247L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4874240L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:38.992953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4878343L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4878336L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.002953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4882439L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4882432L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.012953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4886535L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4886528L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.022953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4890631L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4890624L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.032953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4894727L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4894720L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.032953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4898823L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4898816L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.042953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4902919L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4902912L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.052953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4907015L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4907008L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.062953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4911111L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4911104L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.072953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4923392L, u'eax': 4923392L, u'ebp': 1228256L, u'edx': 4923385L, u'ebx': 0L, u'esi': 4096L, u'ecx': 4923392L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:39.082953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4923399L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4923392L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.082953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4927495L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4927488L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.102953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4931591L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4931584L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.112953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4935687L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4935680L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.112953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4939783L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4939776L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.142953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4943879L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4943872L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.142953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4947975L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4947968L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.152953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4952071L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4952064L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.152953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4956167L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4956160L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.182953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:39.182953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4960263L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4960256L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.182953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4964359L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4964352L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.192953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4968455L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4968448L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.222953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4972551L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4972544L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.222953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4976647L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4976640L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.232953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4988928L, u'eax': 4988928L, u'ebp': 1228256L, u'edx': 4988921L, u'ebx': 0L, u'esi': 4096L, u'ecx': 4988928L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:39.232953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4988935L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4988928L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.262953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4993031L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4993024L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.262953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 4997127L, u'eax': 8L, u'ebp': 1228256L, u'edx': 4997120L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.272953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5001223L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5001216L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.272953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5005319L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5005312L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.302953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5009415L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5009408L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.302953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5013511L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5013504L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.312953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5017607L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5017600L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.342953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5021703L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5021696L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.342953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5025799L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5025792L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.352953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5029895L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5029888L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.352953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5033991L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5033984L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.362953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5038087L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5038080L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.362953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5042183L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5042176L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.403953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:39.403953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5046279L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5046272L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.413953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5050375L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5050368L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.413953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5054471L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5054464L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.443953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5058567L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5058560L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.443953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5062663L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5062656L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.453953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5066759L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5066752L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.453953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5070855L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5070848L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.493953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5074951L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5074944L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.493953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5079047L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5079040L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.503953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5083143L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5083136L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.503953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5087239L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5087232L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.513953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5091335L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5091328L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.513953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5095431L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5095424L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.553953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5099527L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5099520L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.563953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5103623L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5103616L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.563953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5107719L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5107712L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.593953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5111815L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5111808L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.593953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5115911L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5115904L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.603953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:39.603953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5120007L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5120000L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.603953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5124103L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5124096L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.643953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5128199L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5128192L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.643953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5132295L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5132288L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.653953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5136391L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5136384L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.653953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5140487L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5140480L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.663953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5144583L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5144576L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.663953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5148679L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5148672L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.673953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5152775L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5152768L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.693953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5156871L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5156864L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.693953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5160967L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5160960L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.703953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5165063L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5165056L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.713953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5169159L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5169152L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.713953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5173255L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5173248L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.723953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5177351L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5177344L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.723953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5181447L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5181440L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.733953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5185543L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5185536L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.733953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5189639L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5189632L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.753953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5193735L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5193728L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.753953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5197831L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5197824L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.763953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5201927L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5201920L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.763953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5206023L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5206016L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.773953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5210119L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5210112L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.773953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5214215L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5214208L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.783953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5218311L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5218304L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.793953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5222407L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5222400L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.793953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5226503L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5226496L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.803953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:39.803953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5230599L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5230592L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.813953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5234695L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5234688L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.813953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5238791L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5238784L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.823953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5242887L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5242880L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.833953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5246983L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5246976L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.843953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5251079L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5251072L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.843953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5255175L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5255168L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.853953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5259271L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5259264L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.853953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5263367L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5263360L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.873953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5267463L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5267456L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.873953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5271559L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5271552L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.883953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5275655L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5275648L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.893953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5279751L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5279744L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.903953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5283847L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5283840L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.913953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5287943L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5287936L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.913953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5292039L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5292032L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.923953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5296135L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5296128L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.933953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5300231L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5300224L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.933953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5304327L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5304320L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.953953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5308423L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5308416L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.963953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5312519L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5312512L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.973953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5316615L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5316608L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.973953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5320711L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5320704L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.983953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5324807L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5324800L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:39.993953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5328903L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5328896L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.003953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:40.003953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5332999L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5332992L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.013953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5337095L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5337088L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.013953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5341191L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5341184L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.023953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5345287L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5345280L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.033953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5349383L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5349376L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.043953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5353479L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5353472L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.043953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5357575L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5357568L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.053953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5361671L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5361664L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.063953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5365767L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5365760L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.073953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5369863L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5369856L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.073953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5373959L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5373952L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.083953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5378055L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5378048L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.094953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5382151L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5382144L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.104953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5386247L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5386240L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.114953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5390343L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5390336L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.114953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5394439L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5394432L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.124953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5398535L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5398528L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.134953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5402631L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5402624L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.134953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5406727L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5406720L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.154953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5410823L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5410816L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.164953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5414919L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5414912L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.174953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5419015L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5419008L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.184953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5423111L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5423104L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.194953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5427207L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5427200L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.194953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5431303L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5431296L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.204953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:40.204953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5435399L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5435392L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.214953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5439495L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5439488L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.224953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5443591L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5443584L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.234953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5447687L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5447680L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.234953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5451783L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5451776L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.244953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5455879L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5455872L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.254953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5459975L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5459968L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.264953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5464071L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5464064L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.274953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5468167L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5468160L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.274953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5472263L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5472256L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.284953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5476359L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5476352L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.294953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5480455L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5480448L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.304953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5484551L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5484544L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.304953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5488647L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5488640L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.324953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5492743L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5492736L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.324953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5496839L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5496832L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.334953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5500935L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5500928L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.344953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5505031L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5505024L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.354953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5509127L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5509120L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.364953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5513223L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5513216L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.384953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5517319L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5517312L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.384953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5521415L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5521408L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.394953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5525511L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5525504L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.404953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:40.404953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5529607L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5529600L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.414953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5533703L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5533696L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.414953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5537799L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5537792L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.424953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5541895L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5541888L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.434953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5545991L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5545984L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.444953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5550087L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5550080L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.454953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5554183L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5554176L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.454953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5558279L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5558272L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.464953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5562375L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5562368L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.474953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5566471L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5566464L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.474953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5570567L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5570560L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.484953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5574663L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5574656L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.494953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5578759L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5578752L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.504953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5582855L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5582848L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.504953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5586951L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5586944L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.514953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5591047L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5591040L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.524953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5595143L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5595136L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.534953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5599239L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5599232L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.534953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5603335L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5603328L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.544953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5607431L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5607424L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.554953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5611527L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5611520L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.564953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5615623L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5615616L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.564953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5619719L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5619712L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.574953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5623815L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5623808L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.584953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5627911L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5627904L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.594953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5632007L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5632000L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.594953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5636103L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5636096L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.604953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:40.614953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5640199L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5640192L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.614953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5644295L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5644288L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.624953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5648391L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5648384L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.634953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5652487L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5652480L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.634953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5656583L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5656576L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.644953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5660679L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5660672L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.654953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5664775L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5664768L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.664953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5668871L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5668864L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.664953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5672967L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5672960L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.674953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5677063L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5677056L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.684953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5681159L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5681152L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.684953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5685255L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5685248L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.694953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5689351L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5689344L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.704953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5693447L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5693440L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.714953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5697543L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5697536L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.714953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5701639L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5701632L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.724953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5705735L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5705728L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.734953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5709831L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5709824L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.734953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5713927L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5713920L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.744953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5718023L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5718016L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.754953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5722119L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5722112L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.754953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5726215L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5726208L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.764953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5730311L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5730304L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.774953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5734407L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5734400L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.784953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5738503L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5738496L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.784953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5742599L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5742592L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.795953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5746695L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5746688L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.805953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:40.805953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5750791L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5750784L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.815953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5754887L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5754880L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.815953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5758983L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5758976L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.825953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5763079L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5763072L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.835953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5775360L, u'eax': 5775360L, u'ebp': 1228256L, u'edx': 5775353L, u'ebx': 0L, u'esi': 4096L, u'ecx': 5775360L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:40.835953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5775367L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5775360L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.845953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5779463L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5779456L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.855953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5783559L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5783552L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.865953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5787655L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5787648L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.865953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5791751L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5791744L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.875953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5795847L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5795840L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.885953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5799943L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5799936L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.895953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5804039L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5804032L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.895953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5808135L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5808128L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.905953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5812231L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5812224L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.915953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5816327L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5816320L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.915953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5820423L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5820416L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.925953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5824519L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5824512L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:40.935953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 5828615L, u'eax': 8L, u'ebp': 1228256L, u'edx': 5828608L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.015953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:41.065953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6893568L, u'eax': 6893568L, u'ebp': 1228256L, u'edx': 6893561L, u'ebx': 0L, u'esi': 4096L, u'ecx': 6893568L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:41.095953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6893575L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6893568L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.095953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6897671L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6897664L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.105953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6901767L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6901760L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.105953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6905863L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6905856L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.125953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6909959L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6909952L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.135953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6914055L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6914048L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.135953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6918151L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6918144L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.145953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6922247L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6922240L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.145953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6926343L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6926336L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.155953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6930439L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6930432L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.155953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6934535L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6934528L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.205953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6938631L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6938624L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.205953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6942727L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6942720L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.215953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:41.215953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6979584L, u'eax': 6979584L, u'ebp': 1228256L, u'edx': 6979577L, u'ebx': 0L, u'esi': 4096L, u'ecx': 6979584L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:41.245953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6979591L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6979584L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.255953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6983687L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6983680L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.255953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6987783L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6987776L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.265953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6991879L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6991872L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.275953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 6995975L, u'eax': 8L, u'ebp': 1228256L, u'edx': 6995968L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.275953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7000071L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7000064L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.285953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7004167L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7004160L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.285953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7008263L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7008256L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.295953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7225344L, u'eax': 7225344L, u'ebp': 1228256L, u'edx': 7225337L, u'ebx': 0L, u'esi': 4096L, u'ecx': 7225344L} exception => {u'instruction_r': u'8a 11 e9 1d df ff ff 33 c0 40 e9 23 df ff ff 90', u'symbol': u'FindResourceA+0xa0 GetSystemDefaultLCID-0x14 kernel32+0xbfc9', u'instruction': u'mov dl, byte ptr [ecx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 49097, u'address': u'0x7c80bfc9'}	SUCCESS
2016-11-06 21:48:41.325953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7225351L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7225344L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.325953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7229447L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7229440L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.335953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7233543L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7233536L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.335953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7237639L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7237632L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.365953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7241735L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7241728L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.365953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7245831L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7245824L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.375953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7249927L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7249920L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.375953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7254023L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7254016L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.415953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:41.415953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7258119L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7258112L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.425953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7262215L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7262208L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.425953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7266311L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7266304L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.425953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7270407L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7270400L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.445953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7274503L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7274496L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.445953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7278599L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7278592L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.455953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7282695L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7282688L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.455953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7286791L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7286784L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.475953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7290887L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7290880L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.486953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7294983L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7294976L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.496953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7299079L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7299072L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.496953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7303175L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7303168L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.506953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7307271L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7307264L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.516953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7311367L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7311360L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.516953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7315463L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7315456L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.526953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7319559L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7319552L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.536953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7323655L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7323648L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.536953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7327751L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7327744L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.546953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7331847L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7331840L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.556953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7335943L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7335936L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.556953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7340039L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7340032L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.566953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7344135L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7344128L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.566953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7348231L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7348224L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.576953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7352327L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7352320L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.586953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7356423L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7356416L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.586953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7360519L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7360512L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.596953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7364615L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7364608L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.606953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7368711L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7368704L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.606953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7372807L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7372800L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.616953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:41.616953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7376903L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7376896L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.626953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7380999L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7380992L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.636953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7385095L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7385088L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.636953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7389191L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7389184L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.646953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7393287L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7393280L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.656953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7397383L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7397376L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.656953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7401479L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7401472L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.666953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7405575L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7405568L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.676953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7409671L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7409664L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.676953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7413767L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7413760L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.686953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7417863L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7417856L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.696953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7421959L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7421952L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.696953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7426055L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7426048L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.706953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7430151L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7430144L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.716953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7434247L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7434240L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.726953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7438343L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7438336L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.726953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7442439L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7442432L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.736953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7446535L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7446528L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.746953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7450631L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7450624L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.756953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7454727L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7454720L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.756953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7458823L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7458816L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.766953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7462919L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7462912L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.776953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7467015L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7467008L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.786953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7471111L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7471104L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.786953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7475207L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7475200L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.796953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7479303L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7479296L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.806953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7483399L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7483392L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.816953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:41.816953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7487495L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7487488L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.816953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7491591L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7491584L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.826953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7495687L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7495680L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.826953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7499783L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7499776L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.836953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7503879L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7503872L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.846953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7507975L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7507968L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.856953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7512071L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7512064L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.866953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7516167L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7516160L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.866953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7520263L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7520256L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.876953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7524359L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7524352L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.886953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7528455L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7528448L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.896953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7532551L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7532544L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.906953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7536647L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7536640L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.916953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7540743L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7540736L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.926953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7544839L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7544832L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.926953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7548935L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7548928L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.936953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7553031L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7553024L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.946953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7557127L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7557120L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.956953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7561223L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7561216L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.966953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7565319L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7565312L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.966953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7569415L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7569408L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.976953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7573511L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7573504L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.986953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7577607L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7577600L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.996953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7581703L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7581696L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:41.996953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7585799L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7585792L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:42.006953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7589895L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7589888L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:42.016953		NtDelayExecution	skipped => 0 milliseconds => 200	SUCCESS
2016-11-06 21:48:42.016953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7593991L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7593984L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:42.026953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7598087L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7598080L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:42.026953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7602183L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7602176L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:42.036953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7606279L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7606272L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:42.046953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7610375L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7610368L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:42.056953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7614471L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7614464L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:42.066953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7618567L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7618560L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:42.066953		__exception__	stacktrace => [u'0x5271120', u'EnumTimeFormatsW+0x126 GetStringTypeA-0x28 kernel32+0x389cc @ 0x7c8389cc', u'EnumDateFormatsW+0x9c EnumTimeFormatsW-0x41 kernel32+0x38865 @ 0x7c838865', u'EnumDateFormatsW+0x17 EnumTimeFormatsW-0xc6 kernel32+0x387e0 @ 0x7c8387e0', u'DllVbaInitHostAddins+0x2604f rtcBeep-0x1659 vbe6+0x8fbdb @ 0x6508fbdb', u'DllVbaInitHostAddins+0x26381 rtcBeep-0x1327 vbe6+0x8ff0d @ 0x6508ff0d', u'DispCallFunc+0xc3 LHashValOfNameSysA-0x21d4 oleaut32+0x15cf9 @ 0x77135cf9', u'rtcBeep+0x208 DllRegisterServer-0x8c832 vbe6+0x9143c @ 0x6509143c', u'0x1bc50c'] registers => {u'esp': 1228212L, u'edi': 7622663L, u'eax': 8L, u'ebp': 1228256L, u'edx': 7622656L, u'ebx': 0L, u'esi': 4096L, u'ecx': 2088804096L} exception => {u'instruction_r': u'8a 02 8d 46 ff f7 d0 8b c8 23 ca 89 4d e4 23 c7', u'symbol': u'IsBadReadPtr+0x39 IsBadWritePtr-0x3f kernel32+0x9eda', u'instruction': u'mov al, byte ptr [edx]', 'module': u'kernel32.dll', u'exception_code': u'0xc0000005', 'offset': 40666, u'address': u'0x7c809eda'}	SUCCESS
2016-11-06 21:48:42.076953		__anomaly__	subcategory => exception tid => 1900 message => Encountered 1025 exceptions, quitting. function_name =>	SUCCESS